50940d288c3208a33c1fbad7f122cd8d0671d08603d06598370adc8cc552de2f

user interaction
yes
max time kernel
579s
max time network
587s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kul.zip
Size 64.3MB
Sample260804-gprw7sxtbx
SHA256 50940d288c3208a33c1fbad7f122cd8d0671d08603d06598370adc8cc552de2f
MD5 fa3f9f894c0699456f7a08cfb80d6323
SHA1 7a8cf0d5b220f0e4efe84590a208b6ae86b92781
SHA512 a4dbbaa9c54ec735d1c1578350cc3e38a13575c29b8b66526965825efd4b1af0a042771f1d9d6d28f77290551dcce81d8a6561ac3d8db3f9d3295e726e2df45e
SSDEEP 1572864:AtYibWlXGO2oaU4HtQFYbvcUhAcrlg3xemlLvnxL7dby/Pw2zMermDPju:Aud2o14HCYbvcQAdxemlry/I2NUu
TLSH
T160E73379C1F1A5E7C149D276AC3CAF81062771AB50F8C074973147E244A7E9AABD0F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit persistence spyware stealer

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1744	takeown.exe
5528	icacls.exe

Executes dropped EXE 2 IoCs

pid	Process
1308	java.exe
3428	java.exe

Loads dropped DLL 31 IoCs

pid	Process
1308	java.exe
1308	java.exe
1308	java.exe
1308	java.exe
1308	java.exe
1308	java.exe
1308	java.exe
1308	java.exe
1308	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1744	takeown.exe
5528	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
35	discord.com
36	discord.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3348	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	LogonUI.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1190018277\3898946454.pri	LogonUI.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3348	powershell.exe
208	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1240	cmd.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LogonUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LogonUI.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4260	wmic.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHS	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\Settings	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\StigRegKey\Typing\DesktopNearCaretKeyboardEnabled	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\TabletTip\1.7	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Pen\PLOC\Settings	ctfmon.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\1	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IME\15.0\IMETC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	ctfmon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\IME\15.0\IMEJP\MSIME	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\2	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHT	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3348	powershell.exe
3348	powershell.exe
4260	wmic.exe
4260	wmic.exe
4260	wmic.exe
4260	wmic.exe
3604	WMIC.exe
3604	WMIC.exe
3604	WMIC.exe
3604	WMIC.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe
3428	java.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1744	takeown.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeIncreaseQuotaPrivilege	4260	wmic.exe
Token: SeSecurityPrivilege	4260	wmic.exe
Token: SeTakeOwnershipPrivilege	4260	wmic.exe
Token: SeLoadDriverPrivilege	4260	wmic.exe
Token: SeSystemProfilePrivilege	4260	wmic.exe
Token: SeSystemtimePrivilege	4260	wmic.exe
Token: SeProfSingleProcessPrivilege	4260	wmic.exe
Token: SeIncBasePriorityPrivilege	4260	wmic.exe
Token: SeCreatePagefilePrivilege	4260	wmic.exe
Token: SeBackupPrivilege	4260	wmic.exe
Token: SeRestorePrivilege	4260	wmic.exe
Token: SeShutdownPrivilege	4260	wmic.exe
Token: SeDebugPrivilege	4260	wmic.exe
Token: SeSystemEnvironmentPrivilege	4260	wmic.exe
Token: SeRemoteShutdownPrivilege	4260	wmic.exe
Token: SeUndockPrivilege	4260	wmic.exe
Token: SeManageVolumePrivilege	4260	wmic.exe
Token: 33	4260	wmic.exe
Token: 34	4260	wmic.exe
Token: 35	4260	wmic.exe
Token: 36	4260	wmic.exe
Token: SeIncreaseQuotaPrivilege	4260	wmic.exe
Token: SeSecurityPrivilege	4260	wmic.exe
Token: SeTakeOwnershipPrivilege	4260	wmic.exe
Token: SeLoadDriverPrivilege	4260	wmic.exe
Token: SeSystemProfilePrivilege	4260	wmic.exe
Token: SeSystemtimePrivilege	4260	wmic.exe
Token: SeProfSingleProcessPrivilege	4260	wmic.exe
Token: SeIncBasePriorityPrivilege	4260	wmic.exe
Token: SeCreatePagefilePrivilege	4260	wmic.exe
Token: SeBackupPrivilege	4260	wmic.exe
Token: SeRestorePrivilege	4260	wmic.exe
Token: SeShutdownPrivilege	4260	wmic.exe
Token: SeDebugPrivilege	4260	wmic.exe
Token: SeSystemEnvironmentPrivilege	4260	wmic.exe
Token: SeRemoteShutdownPrivilege	4260	wmic.exe
Token: SeUndockPrivilege	4260	wmic.exe
Token: SeManageVolumePrivilege	4260	wmic.exe
Token: 33	4260	wmic.exe
Token: 34	4260	wmic.exe
Token: 35	4260	wmic.exe
Token: 36	4260	wmic.exe
Token: SeDebugPrivilege	3348	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3604	WMIC.exe
Token: SeSecurityPrivilege	3604	WMIC.exe
Token: SeTakeOwnershipPrivilege	3604	WMIC.exe
Token: SeLoadDriverPrivilege	3604	WMIC.exe
Token: SeSystemProfilePrivilege	3604	WMIC.exe
Token: SeSystemtimePrivilege	3604	WMIC.exe
Token: SeProfSingleProcessPrivilege	3604	WMIC.exe
Token: SeIncBasePriorityPrivilege	3604	WMIC.exe
Token: SeCreatePagefilePrivilege	3604	WMIC.exe
Token: SeBackupPrivilege	3604	WMIC.exe
Token: SeRestorePrivilege	3604	WMIC.exe
Token: SeShutdownPrivilege	3604	WMIC.exe
Token: SeDebugPrivilege	3604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3604	WMIC.exe
Token: SeRemoteShutdownPrivilege	3604	WMIC.exe
Token: SeUndockPrivilege	3604	WMIC.exe
Token: SeManageVolumePrivilege	3604	WMIC.exe
Token: 33	3604	WMIC.exe
Token: 34	3604	WMIC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3428	java.exe
3428	java.exe
2204	LogonUI.exe
2204	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 1744	5744	cmd.exe	94
PID 5744 wrote to memory of 5528	5744	cmd.exe	95
PID 5744 wrote to memory of 3348	5744	cmd.exe	96
PID 5744 wrote to memory of 1308	5744	cmd.exe	97
PID 5744 wrote to memory of 3428	5744	cmd.exe	105
PID 3428 wrote to memory of 4260	3428	java.exe	106
PID 3428 wrote to memory of 3348	3428	java.exe	109
PID 3428 wrote to memory of 3604	3428	java.exe	111
PID 3428 wrote to memory of 1240	3428	java.exe	113
PID 1240 wrote to memory of 5468	1240	cmd.exe	115
PID 3428 wrote to memory of 208	3428	java.exe	117
PID 3428 wrote to memory of 2692	3428	java.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\kul.zip
1⤵
PID:4320

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5992

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\shutdown.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32\shutdown.exe /deny Everyone:RX
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "expand-archive -path kul.zip -destinationpath extracted"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
  j\bin\java.exe -version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
  j\bin\java.exe -jar gang.jar
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('LA ANANI SIKERIM ORSOBUCOCUGU')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:208
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32.exe user32.dll,LockWorkStation
    3⤵
    PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000498 0x00000000000004E4
1⤵
PID:4416

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39e5055 /state1:0x41c64e6d
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4636

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000188;000000000000018C;
1⤵
- Modifies data under HKEY_USERS
PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 712e532df307cd5adca7d3f0083e360b76bb7a4f77b2dc0b37b70088736d6c65
MD5 158484f2a0f8ee2e115185013758d8d0
SHA1 903c3b10545d406698f34054d9d2acf4ba52a542
SHA512 df65ae25dcd83936aa877864d53240c96b688f56fd81d68e92fdb072aa874b9c2997fd14d9b4f93e71fc137122132db6cbd6a982b295440c5052841e6454ae57
TLSH
T14A317933B3DC86E8D899413A00CAAD1037B693D790DECED77B84D249B53F298DE60690
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_k3wxirxp.dnv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k3wxirxp.dnv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gang.jar

Path C:\Users\Admin\AppData\Local\Temp\extracted\gang.jar
Size 23.4MB
SHA256 98e7afec05dd1bde9286c3154bab1046a0562aaacaec6d67f2574efc4200b91a
MD5 cd4a9abb72bdf45a233099b694ae9179
SHA1 2f5e3c6a34632f031619a0fd98dee35b8ab8373e
SHA512 5acf447bf6b929e6556ccdb3c893d66fc5eb631d4e01aedfed82739583f31a52405743ff2c1f8ff3ffdf4af63dc508557c4b3cc0fe66da1a3a55f9fc3eee2d0c
SSDEEP 393216:7eOxziDWJzRiPArb9m8W6BaA9P3lzSLRxr6Y92ZepDxbIpNTp24ER543:7eOxe6zdYlA9vPZsZYTtEY
TLSH
T1E1372323A8DB8829DD7769F361C146A3642E12D9F80BD03D46F04FD15B73A8BC396768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\awt.dll
Size 1.4MB
SHA256 e1f6af2968db3fb93d0846ce930d9bcc88ed423d79786c13287931f81c526d9b
MD5 e44ebb01298f471e9ce107a4196e1afd
SHA1 d9a79b90d3bc5241513e178fc3ffdf074a3d4157
SHA512 df3f75238fd97c3d91a8543da8b126948ca515c75368b672a4d2bc90b210e9526d3949d9630d3c39ff23361f26688b86bd748cf0722b3a0ccbb6a191a2c018b4
SSDEEP 24576:fSGaNDeY6lWXXVwSm+xRapx6u9heHhf0+USiH/tCWI545sCJfHewDcyZ4nDGy:fCNDeY6laJUeHhfHiftCWI545sq9DaDl
TLSH
T1E7656D03E3950199E4FB80B8C14B561FE7F274151340A7FB67A59B2ABF67BE4623A301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\extnet.dll
Size 23KB
SHA256 452aa9980c07293cb3053c574f2ceccb8e4975400aeff702db8af3e807602cfc
MD5 4cac3b01e5b2164c324e03f0f44f7a3b
SHA1 c788af3bd1e98e77e0884e311613f36e490d5579
SHA512 2df9d8c0b344b9a2ac6657796ed4542101badafb5b5849a6c0e0a5b5a5e144a08eaa697bd4711b3340b1dbf3e58542ae21abbe4bd7cd36b66021d1aed8bb7af8
SSDEEP 384:6cW19Fx5s3Xaf4rhcSBn0NyEIYi2mL4/y8RFvIIvZ5P+:C1XKXw2nxYiDLk5kIvf
TLSH
T111B28097CD800899DD235570A0A71E26F9B77A501B51E3DB2368D0180FB63417FAE7BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.dll
Size 144KB
SHA256 67da6582a0f84242e05d0ed4b8fb4ff81ca96e45e3ade6573b7e3a23c1fa148b
MD5 691113f3eb2364f44a212e2baad9988b
SHA1 d198e3dc87354addf7d0819794759b4baca36085
SHA512 a8fde3590b44cd36237a5013bbb7444317d30f1727f72de47a471bd4851402003c92613a14d11e472a55eaf18ef8efd502760531d81ce6be05617f5951fe9f55
SSDEEP 3072:evgMjJQCD9yPTQJ8HKjtzj9kax6BLUYPhYOBJ0FqPrLrbopCEY+var:RMCWptd6VUoC
TLSH
T13CE33B0FB34640A2F42AB6B8701A810BD37A7461412C93FA43E58A5F8F6F7317E97795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
Size 49KB
SHA256 b3afe83e1ab067da4c56f1a7b2ba4c14ec832d694333f35b2b45178e9ac596ef
MD5 0defc9439e85882fd63fa06be759edc2
SHA1 98f71abaa7fcb4bfba1fafba438c1444b55d16df
SHA512 c0a8aa540c6808cfdb02d7b1d9dc8bd4ae3d60c670e8b19d69cb3b4f3e8c25c9bc7a100592cc82b0a725100a687a21121b6358734756cc67de753ec68b0458e0
SSDEEP 768:9OpAQF9M5R2TyJ5R3s8D/bkt5Ruz3Vb3gD5FYiDLk5kIv4D:CASM5RdJ5R3sozkt5RA3gD5F7VIv4D
TLSH
T15D336C47AA083C81F42F84F188A6792655B4BD032BD173FB7DC6B21E0971391A9176EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javajpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\javajpeg.dll
Size 178KB
SHA256 2ad9b9c0857e34a0af47c0749ee303bdcbaa22702aa3008f62de159128e3b1ca
MD5 6f06e9c2eab0f3375745a573cc722db3
SHA1 6978166f94dec07e0022b2563b4262b8f936173d
SHA512 6c3e6716e20412598b050aa8f8ed19c871f5cd82d1352da296a66ffde4eecb4b3601b34fddf25c4e78b6a6690be1d208f96f19bd9b1f9d5534124715f3321b66
SSDEEP 3072:8hrSa3cUTaTFZ39ndo7Ru/lkSMCNmoINBzaRSPh1ilia+v:8hrSa3NaTFZk7Ru2SZmbNwAPh7h
TLSH
T1F1045C53B6B01094E97BC0BC86B69627E6B27055131497EB8794C3B32F53EE16E7EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\jimage.dll
Size 33KB
SHA256 825f26dc5f32773722fc68565ecba76abd7928487a08c3403fdd2e0689f0bb51
MD5 d43deb5f7b5e34afc846b83ccda0d6b2
SHA1 3d4bd54ea01a21eb7543699630c2f87e7ae8be7d
SHA512 3c16c26150d194c68e542b07371db23b6ab81f690392b3cf0d1d447ffded1d12d24aa002dc9d087f43b4a1f0323423c525674e50b6181735c1223e4caa758042
SSDEEP 384:mXpYMr5gSz7lVypm4PcySd9a0VuikyvRVBNyEIYi2mL4/y8RFvIIvZP2nNV:mZbjypFG7a0VuiHvRV+YiDLk5kIv0N
TLSH
T13FF28E5AEA845859DD27E53CC4AA9A1FE6F2F9425F51C3CF1720821E0F333803BA8765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\jli.dll
Size 87KB
SHA256 8a838a176148e7651aa041c1f1f704176030de3f7dfd3cfbcc8fe0e6f148ce4c
MD5 5f753fc3e370c34212acd71a2ff5ace6
SHA1 bc3ca599d250fb0d5c672818b4d8553e9bbe9787
SHA512 0cde2b802d1491380f7734eb231d5c471d9b0c9687d8c86020d3fc6be202e5b73cd02fc5c22f34af689c3c51ae47ea5f8f7cfd9061212344f6057cc74964165a
SSDEEP 1536:jCV/KaLiixnqtkDwf9WKyc3m+zBIOkygcJtG2P7VIv:2VHiixrcfRyammkyggg2P+v
TLSH
T146938D5A53E011A1DEB7C1B8D9B05A0FD3F1F0562761838F136885AA0FA36623F1DBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsvml.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\jsvml.dll
Size 849KB
SHA256 3b99eb724cbbc35da1c158cc68d94b65095eaa4c772d9a1ce86678c9f07cfb72
MD5 30f36cc2c44b7e29b06035a7b2e585ab
SHA1 ebfa1b49e95ba528369397ef44571f0d81c3c4a0
SHA512 ad9119102573c2391bcc29ed7c8f2738f9689562945278d9bfcaf6abe61638e8140caf58dee7bc2527489de06d65e09b0ca5c1437e48353ee19cbb695eec5129
SSDEEP 12288:fRybOUKnvJNeCs5wHuumj/V71AVNV+Ssc3:fobO7JN3qwHjmjN7wj+9O
TLSH
T11905BF82F81284CDC03534B024FFBD95A91A1CE941BC0EB32772AE9D2AFD7467957A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\management.dll
Size 29KB
SHA256 dfedea981d5182dbf18be25cc6609d9cef361a47a3637741002b63b2a89027f1
MD5 9936d76532840e42a8179ad5e33d6790
SHA1 b8b83f7e5adfc749d6541809b06b0504aa6f46e4
SHA512 e5e12960a9cda90b42eca9282f5bcfd997f28dc03e82b76d2540f5aecee42b07fd21988a49cae1d303032f9f21af422c7ca14fe8b1f1bfb2ee03c3e64a2078b0
SSDEEP 384:MB56nqKj6KSLNjToyz2ViI0hc8nhWsufksNyEIYi2mL4/y8RFvIIvZvUS72v:w56nqW6lNYUS58hWBwYiDLk5kIvb
TLSH
T16BD24952A65C6442E2DFB53070E1063696B3B5C61FC093831675C63C4BBBFE636782BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management_ext.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\management_ext.dll
Size 35KB
SHA256 4eb8c50736fbca5cdbdac0fc99aaf7f88fd930e6aad95773739e4b5a8899d8b6
MD5 e09e04792499c83a577c51ec7554e227
SHA1 74b959c1c73610d5081f31fbcfc43b04fc68dbe2
SHA512 d8ff1e9c8bec6628b25a2b4b594295bc2be3372bfff4e7daef023d75da0a856912577f16d033ba0c87d061d8e7a9fa1b70cc1d072c23da5984f83291bb2c502f
SSDEEP 768:WiVJHDYLzsZrWFQMzTMDaYEyQYiDLk5kIvpL:5VDYLWWFzgDa/yQ7VIv
TLSH
T1CCF27D6792980883F84BD675A0601A23D6B27C6222E2D3CF5760C62F4F63753772C79D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\net.dll
Size 96KB
SHA256 80c85f578afa95e52ad502b05c669030a8f4245e3c289534f1d81ef6bdf97127
MD5 e3c0833fd8cdaa6e5d48797d7aa8a81b
SHA1 7e7fd25f5bcf693be0533aaeee1faec194fcffdf
SHA512 b5ac6a52e385ed33a6ff5d727e8047f61b0bdce038ee42a2065c7d11c8bc5c2339932d6a30a9c885929e42d5c20f53696386d64dea0cb2d6ef37a4448623028a
SSDEEP 3072:RPSfwd6sn+hIcB/lRXsm+xd3MXf9ESQ19pP+v:R9dnni/lRXspJMv9m9Y
TLSH
T15DA35B05635824D5FC77D2BC8586821BD7B3B0B02650839F13A6C66EAFEB7713E19782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\nio.dll
Size 78KB
SHA256 aef35f2aa1817fa845f2eddc678e671424fea538fff5bde207789ad9ec8c5faa
MD5 7835cdaa143f25b24f3cc6ae44a3ea9a
SHA1 ec0b3ff9a37186ac703c2807d5cc1f9387ca7f1c
SHA512 cb4a319e24505e4f067e452a0d660844491a13dc91e0939812a05521a008ea364d02e8916841d3e2fd94a965e81c69a8bf5c3cf6074a95682f1ba8986fb52940
SSDEEP 1536:r0p78LdqTFVd44arFkiZZ32supMTlB47VIv:r0pqIFz4rLZZ36pMTb4+v
TLSH
T1ED733AA65364849BE83AB53C429A5747E233FC114510A35F5368CB669F2F2B33E3D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\server\classes.jsa
Size 10.6MB
SHA256 b1a653c410f6cba64fa236613714b6d487407ae19b1816ecfa39056da72811cd
MD5 877c112b424f62c6e2e26840ab8da2ef
SHA1 a5caf0b8dbdc25fa18098c672f321717303f503e
SHA512 8da645a32a2c3434db24c683cef8704f6110718046965741823293de26d5b8a1b8ff5b044cf7cdb0f39d24243f00428ae8f5a41e5dab923fb1eecd1eaa5b54f0
SSDEEP 49152:N1H5FSS7kGhaS3k9yAr+2fOSlPaxxwT+I/y7GHTR1D7:Nd5FSS75ha91+2fOSlPY4+I/HV1
TLSH
T17CB6E55BF550B657C53887758AA783A0A334B462AB4387C73B84E37E9DC32D44E42BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\server\jvm.dll
Size 12.1MB
SHA256 89c64a12328b82bbacdeafd0cbcabf175aeed0581f99fe0f737ddbd962c25fd4
MD5 9c5f15013d3e9a5947b1c9523aeb3642
SHA1 64fbc24e59839ab88769412ac46b37adfb793fa3
SHA512 12e7b0b1da23edcc3134a9167dd1150e53ae91b9636470e67363f9b12d961dbf640ddae99b11772ea0d3b0f5ae52f1f63d5ad90e4c49a45ca1ed9da74c309e2c
SSDEEP 393216:TySHyrwXSq02pT1OCf01QkKyRHz8f79+PQIaGI5jm90LZcAluFVfxY5s2FoRiIqG:TzWL
TLSH
T185D68C1BA37480D4D82BE178CA2F5A0BE7F2B4945374DBDF11A846496F53BE1963E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\sunmscapi.dll
Size 46KB
SHA256 aa39dd045cb3405bf415c127110f1bc8f6776e0495a70f5c23579108750d132b
MD5 cc472f179e85f762a412b14040459e2d
SHA1 67acc534402f9fd7c3984439e524db9c77695ce7
SHA512 f06531beffd2dfa39526fe67fb76369ef40d478684ed227a8fda274888c7484af3179b95ee33e31d46d22fe33585fa6382b7372722dd6deaf476d5d5ced1959c
SSDEEP 768:ypcVGjySH1vLUdVmY3RukkJRs0mEZwyI2ixaTOKYiDLk5kIvq:ypcsyS1xk8Rs0mEZwyI9xaTOK7VIv
TLSH
T122236A1BC7A008D1FCA3C9B8C02A921BEA72F8865021D78F1355CA199F67B71B73C365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\verify.dll
Size 53KB
SHA256 4fc4990f37b3967d33523e540438e2f1cd64784c1d587f369fe230ca7639aca8
MD5 792d3ee599a85f9a7fffc606c58f67b1
SHA1 c77a550f4600314d4b952e7b1fdd008afa4d19ba
SHA512 8c55e5baa269699b6b090dda43bc4b271c906aa57c0bff35d95488900ac18da4476103b2cd44ac873a21bda19969a6a71b88e9e1cf5d875f4c13ed0c633ec6c8
SSDEEP 768:yHCLyeM3rBXI38xzmjNSbYpviCCu+pXr5KZ6WR2DOPyD1JHYiDLk5kIv6n:SCU7O38d3bIRCu+Z5QyD+yBJH7VIvo
TLSH
T1DA335B5792640076E483C238C663BEEBDBF1F4451B0083CB525487DD3F97BA0AB557AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\zip.dll
Size 85KB
SHA256 d4b544165c60f20dd092155c43d36dacb1f84364cb8c9da2d784b99f56127a71
MD5 c4c6f2983a3b9a41c7dad7e917bfbc49
SHA1 6c936cdda5546f25fba5b16b95a46c63e7141521
SHA512 501ec4d27e35be543f430a6cfe27da6f33dd3006b7bcd582f3b26d66065120cbd079a25f2f187ee625228e8c02507de416f598fd453f60dd94d8752d2beb922e
SSDEEP 1536:yFXvKtAnZ4qAvZ9cRR0K2cIOxwaFVJ07VIv:6XvKtAnZLAMb04xwah0+v
TLSH
T16C838D559AA05155DEFB85B0C9F34B2FD3BAB04152A0478F6398839A2F532613F4C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\conf\logging.properties
Size 2KB
SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
MD5 0f00ec3e7a7767a4efeae1875fb5f3d4
SHA1 167808418571e9209b952188ddab2f4e62920e68
SHA512 e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504
TLSH
T13B51EE5EAB4E2D35434E00AA5A7FF6527E1898BC1C23A5F6B35E6304711D83485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\conf\net.properties
Size 7KB
SHA256 56dd1f6095c189c1052f6baa32e457efc09de4832e19cdb82bb236dc8abfee9f
MD5 0c091bb338f924911db463aec454ba8b
SHA1 69e86a02207c1126a0d9faf9362a8d1798b140ad
SHA512 d0d257c7b0fc6059faef88603c07a9e1cfe6692359eb634b3436a02723ff015d36d523e1c2a252649db7cd4d0e24be114c042e3e209ce027ee07b7816466109c
SSDEEP 192:/LVGG4f4z346et5m27SnCgTe93hf7k9SrnF:ZGxYCUCgY3hzk9+F
TLSH
T1DAF17283BF46B7354399C291E21EA7EEE32C913C5C3375B831AC850D2619C76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\conf\security\java.security
Size 67KB
SHA256 02010d55fcb59dc5c53e1a0f92c256ce381fc682465885af1dfbe0e9b96f7a25
MD5 482819bbc4f8d6e6272410dbe1793665
SHA1 292b0c40512bed93f255ba297dff829296cd8acc
SHA512 041d32e5ed94bb5d94ebcbba26ef9481f5c61ce890de860d4dfe3eb81e8d9c918f89467e0c10cb3a5b8e3f13da067de3a7d87c2ebe013b5124d137a6c2bf89e9
SSDEEP 1536:r2My8SiqOpjJPFp5/jTGHu1UoQhzYilNndOcs0:3qOXPFD/jTGO1UoQhciDndOcH
TLSH
T1D963F622BB896B7206F211A363AEF1D9F76DA12A32325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\lib\security\cacerts
Size 163KB
SHA256 b93d8bb4c2b66e49ccb409bff72ac144e2855546c1c2c599dfeb2f0f9efe2bbb
MD5 2ce2f7e9e3c28f18e30a1213a3710bf6
SHA1 dab0ee0aad316cf7cf7888990fdc60bc00135022
SHA512 898f140885e0f4e69c57795b6bde799069c86f13ae0c10879f9b1f00521ab18704a189db6d5f018902f00eb28ea0060c53b8a4b8a6d33d2919d8b240977069b0
SSDEEP 3072:8G6VOXx9tz9UYTD6Lg0/YF3bjjtcGlJwGyoBTqs8VT8hV7J2Ppg:8G6Vy9txUa6Lg0/+PO1cTmF8hV7J2Ppg
TLSH
T188F39E5A4F387955BFD2AE68A2C8D5373DB9B6D0679B28172110C0F12E927E17DCC02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\lib\tzdb.dat
Size 100KB
SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
MD5 df8a313edca47a1b2537b7ec047ce4de
SHA1 449cd5af08a45e2b017e670b3df9c8bf06de0c7e
SHA512 7c4c67d5793bdbf3f9b7dec1360b9278ad7206e66f6917568e2fc04e0fbc019b504edc35870eae143f9f313d5b7eca81404d5c4783c7fc61e0f8a1ec1d18e36e
SSDEEP 1536:N0ExeF88hPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:NPeq8hPdrcWzbVj0hJzdxuT/5ToU
TLSH
T149A3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\lib\tzmappings
Size 21KB
SHA256 36dc51c4bf787f640a4b45cbb84ab6954f6e595cbd3617c2f5a4e1e607b38bff
MD5 b02ee240a8db902961fe886a19beba16
SHA1 c52c42d591f4c650b629e6b374e967e211fb5aeb
SHA512 024811961511b7182860ed03a5670f82412a45d005a1db0876f6b0c9af7e96c104566abff0ebbded11a780349444214291f439039d20fb92071c7dd24bda0e23
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGiF3yzA6bb/KOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+q5a3W
TLSH
T1F9A24386B06662D4C073EC0D7B527AD3F886F3C499C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna8169397006817425252.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna8169397006817425252.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.45.3.0-8530529b-0070-4982-b53c-f49018413c2e-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.45.3.0-8530529b-0070-4982-b53c-f49018413c2e-sqlitejdbc.dll
Size 947KB
SHA256 14dee990e031f70c879d5b1b07dc1f8e077952db51e3bb37282f37684f06e18d
MD5 fc683f23febf5492ce94521b369014a8
SHA1 8b72934bf6d8885cdcbf028867d83b1f89ad1b21
SHA512 f022f19763d5d27160826da4b93c1c5eabc0c7f61fd1f39f4bcca3a5d16f721fec6fcf5bf78ea8691a190dcece6848c33e7f51777f6b8812aadec98cdf311f56
SSDEEP 24576:5iGt+jeMSQXL9Ev84DfQXgLlzpqOHN8WaI:1ZnQb9Evj5vqOHNH
TLSH
T1BF256C13E39640BDC47BC2B0872FE323B632F4496134E95F6AA48B642E61F60975F758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssc13429363486944070028.jpg

Path C:\Users\Admin\AppData\Local\Temp\ssc13429363486944070028.jpg
Size 32KB
SHA256 1fd3fb2da8bb2fcb485a4e7a6ab364490197ccfb872ba2d9e7b6d6a1a26c5bb9
MD5 4f94efa6c4e0c8f20197b364df2e163b
SHA1 aaf22d1ed2f1ef37e5b3b8f6e7f52eb53eb6f6f6
SHA512 337c2478b607b49cb54b09e382c7d0fc7ad41e0ba454b6fd91df6f67fdb2a2164d6c1afd2874ceeccb7344db363d9cde4bd156667f3219b619146d0a4fcffff1
SSDEEP 24:9H4sozWfo0XxDuLHeOWXG4OZ7DAJuLHenX3o3:14/znuERAW
TLSH
T1D1E2A25E6755C360DC1795FA15571F92E6CF9B8379503606297082BFCD109C487CCA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssc5504795164410305680.jpg

Path C:\Users\Admin\AppData\Local\Temp\ssc5504795164410305680.jpg
Size 144KB
SHA256 c9ad382e17a63cd9d0440aa2ca7d95f162230a8a0a732e380cf2a8a1e6b80c15
MD5 ef343d537c2f341f3d8d6856a26fa200
SHA1 8f7a7281a4d2de6637d7843e2630308a96e7fcdb
SHA512 538d970ab05c0f59e752862d36a11db4db0cb464cfc49b4ef824fff11fb2da1e03bde003b8aa4c2f40554919c01d9e67deaf99c063aa60f81ef28658a17a6c1b
SSDEEP 3072:j2HBIxdL5W5E5c34J+K6j0CojjtzDCyuTs2Cn8fvlS:jIIZWfTgCKtXQq
TLSH
T1A0E3F5034C0C9A92E12986E4BE031E9C3F466B5DEC963DFF44128EDB3E606664D9D52F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-971-0x0000021A9E080000-0x0000021A9E12A000-memory.dmp

Download

memory/3348-309-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-52-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-16-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-298-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-289-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-282-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-281-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-250-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-9-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-8-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-7-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-54-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-13-0x000002569C420000-0x000002569C4D2000-memory.dmp

Download

memory/3348-667-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-53-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-12-0x000002569BE80000-0x000002569BE9E000-memory.dmp

Download

memory/3348-19-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-6-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-43-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-22-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-14-0x000002569C4E0000-0x000002569C4EA000-memory.dmp

Download

memory/3348-5-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-15-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-17-0x000002569C640000-0x000002569C652000-memory.dmp

Download

memory/3348-0-0x00007FFEA4BCF000-0x00007FFEA4BD0000-memory.dmp

Download

memory/3348-18-0x000002569BE80000-0x000002569BE8A000-memory.dmp

Download

memory/3348-4-0x00007FFEA4A40000-0x00007FFEA53E4000-memory.dmp

Download

memory/3348-3-0x000002569BDE0000-0x000002569BE02000-memory.dmp

Download

memory/3428-937-0x000002BC1F070000-0x000002BC1F324000-memory.dmp

Download

memory/3428-936-0x00007FFEAC2A0000-0x00007FFEAC395000-memory.dmp

Download