6586132aeebbacac37b53a80372b249cebd2c9507fae00accf2643986ceee422

Analysis

max time kernel
299s
max time network
307s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/09/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MateFall-nstaller.exe
Size 171.8MB
Sample260922-pydd6sef48
SHA256 6586132aeebbacac37b53a80372b249cebd2c9507fae00accf2643986ceee422
MD5 1d7afdfe044bf24b82b1543c960d8386
SHA1 ef9699308e099cda8b7885f35776abb1bed46927
SHA512 b38d3276c5b9eac8491713407180eaf721de7271ca64b21916b1fb1ddbfad29a77b675d707ac5c60fb003136827d56272ffce38d98aba9fb948a6764e2fd6e89
SSDEEP 1572864:TasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:b4fc/M+i6xCL
TLSH
T12B888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	javaw.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	javaw.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	javaw.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	javaw.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	javaw.exe

Executes dropped EXE 1 IoCs

pid	Process
4724	javaw.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\SOFTWARE\Wine	javaw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\SOFTWARE\Wine	javaw.exe

Loads dropped DLL 21 IoCs

pid	Process
4756	javaw.exe
4756	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe
4724	javaw.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge WebCache = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\WebCache\\jre\\bin\\javaw.exe\" -cp \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\WebCache\\9c54682785d1.jar\" V ira-ed6140ab"	javaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge WebCache = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\WebCache\\jre\\bin\\javaw.exe\" -cp \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\WebCache\\9c54682785d1.jar\" V ira-ed6140ab"	javaw.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
9	discord.com
14	discord.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5044	netsh.exe
1872	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\VideoBiosVersion	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\VideoBiosVersion	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	javaw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe
4756	javaw.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 33	4756	javaw.exe
Token: SeIncBasePriorityPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: 33	4724	javaw.exe
Token: SeIncBasePriorityPrivilege	4724	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4724	javaw.exe
Token: SeDebugPrivilege	4756	javaw.exe
Token: SeDebugPrivilege	4724	javaw.exe
Token: SeDebugPrivilege	4724	javaw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4756	javaw.exe
4724	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4200	4060	MateFall-nstaller.exe	80
PID 4060 wrote to memory of 4200	4060	MateFall-nstaller.exe	80
PID 4060 wrote to memory of 4756	4060	MateFall-nstaller.exe	81
PID 4756 wrote to memory of 3308	4756	javaw.exe	82
PID 4756 wrote to memory of 3308	4756	javaw.exe	82
PID 4756 wrote to memory of 2396	4756	javaw.exe	83
PID 4756 wrote to memory of 2396	4756	javaw.exe	83
PID 4756 wrote to memory of 1896	4756	javaw.exe	84
PID 4756 wrote to memory of 1896	4756	javaw.exe	84
PID 4756 wrote to memory of 2220	4756	javaw.exe	85
PID 4756 wrote to memory of 2220	4756	javaw.exe	85
PID 4756 wrote to memory of 4212	4756	javaw.exe	86
PID 4756 wrote to memory of 4212	4756	javaw.exe	86
PID 4756 wrote to memory of 1492	4756	javaw.exe	87
PID 4756 wrote to memory of 1492	4756	javaw.exe	87
PID 4756 wrote to memory of 2116	4756	javaw.exe	88
PID 4756 wrote to memory of 2116	4756	javaw.exe	88
PID 4756 wrote to memory of 4356	4756	javaw.exe	89
PID 4756 wrote to memory of 4356	4756	javaw.exe	89
PID 4756 wrote to memory of 1608	4756	javaw.exe	90
PID 4756 wrote to memory of 1608	4756	javaw.exe	90
PID 4756 wrote to memory of 3240	4756	javaw.exe	91
PID 4756 wrote to memory of 3240	4756	javaw.exe	91
PID 4756 wrote to memory of 1384	4756	javaw.exe	92
PID 4756 wrote to memory of 1384	4756	javaw.exe	92
PID 4756 wrote to memory of 3752	4756	javaw.exe	93
PID 4756 wrote to memory of 3752	4756	javaw.exe	93
PID 4756 wrote to memory of 3264	4756	javaw.exe	94
PID 4756 wrote to memory of 3264	4756	javaw.exe	94
PID 4756 wrote to memory of 2100	4756	javaw.exe	97
PID 4756 wrote to memory of 2100	4756	javaw.exe	97
PID 4756 wrote to memory of 2860	4756	javaw.exe	98
PID 4756 wrote to memory of 2860	4756	javaw.exe	98
PID 4756 wrote to memory of 716	4756	javaw.exe	99
PID 4756 wrote to memory of 716	4756	javaw.exe	99
PID 4756 wrote to memory of 3992	4756	javaw.exe	100
PID 4756 wrote to memory of 3992	4756	javaw.exe	100
PID 4756 wrote to memory of 2152	4756	javaw.exe	101
PID 4756 wrote to memory of 2152	4756	javaw.exe	101
PID 4756 wrote to memory of 4420	4756	javaw.exe	102
PID 4756 wrote to memory of 4420	4756	javaw.exe	102
PID 4756 wrote to memory of 2252	4756	javaw.exe	103
PID 4756 wrote to memory of 2252	4756	javaw.exe	103
PID 4756 wrote to memory of 4432	4756	javaw.exe	104
PID 4756 wrote to memory of 4432	4756	javaw.exe	104
PID 4756 wrote to memory of 4292	4756	javaw.exe	105
PID 4756 wrote to memory of 4292	4756	javaw.exe	105
PID 4756 wrote to memory of 3336	4756	javaw.exe	106
PID 4756 wrote to memory of 3336	4756	javaw.exe	106
PID 4756 wrote to memory of 672	4756	javaw.exe	107
PID 4756 wrote to memory of 672	4756	javaw.exe	107
PID 4756 wrote to memory of 1116	4756	javaw.exe	108
PID 4756 wrote to memory of 1116	4756	javaw.exe	108
PID 4756 wrote to memory of 848	4756	javaw.exe	109
PID 4756 wrote to memory of 848	4756	javaw.exe	109
PID 4756 wrote to memory of 4140	4756	javaw.exe	112
PID 4756 wrote to memory of 4140	4756	javaw.exe	112
PID 4756 wrote to memory of 4356	4756	javaw.exe	113
PID 4756 wrote to memory of 4356	4756	javaw.exe	113
PID 4756 wrote to memory of 5044	4756	javaw.exe	114
PID 4724 wrote to memory of 196	4724	javaw.exe	116
PID 4756 wrote to memory of 1040	4756	javaw.exe	117
PID 4756 wrote to memory of 1040	4756	javaw.exe	117
PID 4724 wrote to memory of 196	4724	javaw.exe	116

C:\Users\Admin\AppData\Local\Temp\MateFall-nstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MateFall-nstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\MateFall-nstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\MateFall-nstaller.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\MateFall-nstaller" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,16937629692941066542,4436786754409675049,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\9c54682785d1.jar V ira-ed6140ab
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4356
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4928

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\javaw.exe" -cp "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\9c54682785d1.jar" V ira-ed6140ab
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2044
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9c54682785d1.jar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\9c54682785d1.jar
Size 33.6MB
SHA256 76af97e5f858949c702a9e3a54fbcb52700374241be4de4c0ac078435bccbb60
MD5 15ddbe6545b8d5dd9bb06e801f2cb816
SHA1 a3be06a5859c402a5b9b0e1e76c938ddfc8a1950
SHA512 97fb2a3ac8c49d7dfde51a90681b2c7848a2732709e55edf7de14b0476fb8db94b513b6b2a0b45cc0aa4ceb46932f32ed701165a22dd91600d53759d27680ac7
SSDEEP 786432:vDfRfhTlWBOgGhy8WlbvwIe+0NokHKtFFZKBiuovCdMjOQ:rJplSOF3WPD0NoptIBiuoqQ
TLSH
T1597733E6BDC6C525C96391B291C2935FE02992D8EB06C13F0BE249C81D71D8E8752FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\awt.dll
Size 1.4MB
SHA256 6fd29b7267eb02df00229b44f34d561be1e56b313ada754bcea1acf7c3562a83
MD5 48c11375063ae44fc65112e4fc3a1332
SHA1 b675b044d7b3e10edfabd96c370dbdddf0d4f57b
SHA512 4c88f7854baddaee534ea3aa7d06673e5d60c1c41d6578484633d5b4c5b841419d2cc3aad1ca5105d1ebae85135053ff58faf81fc194985141ae0dd2645ec45f
SSDEEP 24576:bER3Eq7xSoy5VPbwd71zZpFqyX3FI1IL73qWKIUR7EtKPTePvh:YGq7xSoyTJaL73qW8RI66h
TLSH
T1E3656B06E3A40194E4EBC0B8C25B961FE7B27419134097EB77A5872EEF67FE46239311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontmanager.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\fontmanager.dll
Size 1006KB
SHA256 2cd3b5ebc97aff79685c34024ef13a3880aed9c26bb9d82c673ee765b134b6a5
MD5 94edd599b40890549fb1553052ec43e2
SHA1 24393bc1b97bff0d648a0d0e6ab539605623a47e
SHA512 eb35be12c6d78d68138440050935b74fe5831aa24dd907e66559be8690c2be99a14e2f26c7c51e86aafe5074b154e61e8a6c610618fcc824eb14c836707b69bd
SSDEEP 24576:WahlzzWr8P1ZjElI5yENXNt1/A7dX4YKsx0Vd:WMlzzWAPjElIwEZN6dX4YKxVd
TLSH
T136258C4AF18354E8D53F907485A2C407E7B2B40203199EFF56A0A659FB27AF52E3F724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\freetype.dll
Size 547KB
SHA256 213a2ed1d5130ce40b5d3b8495fd41d9841c844da1116fd3a2b4eab85259c20c
MD5 d1807d3f2211ae17101d5523448f279e
SHA1 699a4ddc973c8a203b8b64529a4fdaf2058da798
SHA512 a64a2cea83902f0c474fbeec549b5aef97ef21a9991b6f954fcd31e300d39e40effd1ceb4f6446799b0708ebf9dd3fed1dec4f79934d4f05ec758feddfbce202
SSDEEP 12288:lszYuQyHnwOA7AYHqUQsNKxczY9J/kxUdgfEWmpLItEvL:lsz7vwOA0YHqUQsNoczY92x8ZD
TLSH
T198C48D82F7A417ACC6A7C1388767871BE771B40513119BDB22E04B6A6F53FD16B3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\java.dll
Size 119KB
SHA256 9b484b6a703e890292ab3bdb43c81c17eac1eecce585a28205d32ae42c3bc049
MD5 71e0b8b254ce0a6a6cb057e5c8d63989
SHA1 b9c8755987ed825398a74384720ce3bb3be36188
SHA512 bf546a4c25297ba50407874be3272c26d9fef9d7659bc0bba5e1ce17ea6db4849f1fa96712b607c20a78b49a7708a2faf04edcd0cc1f787812daebfc44c4e486
SSDEEP 3072:g3wQqkpOFiVohaEOvYej03X4yNGBv3UfrRa2wOv7:YIkpOFiVoKgeYaY7
TLSH
T18FC35B5BB3558087F47EF1BC806A864BD37274B11141A30E43A9CA6E9F8FB713D1AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javajpeg.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\javajpeg.dll
Size 176KB
SHA256 bc96c9e9e4a3eb21b06a5f3107229d411415ecc686c10219421626f8a1871147
MD5 fcff5fdb047d882de72ccb25c856d5fe
SHA1 1a69b2f6992d042fca521257948132f643e55bce
SHA512 ad34bee5bc6f4f89a8505917aeeb44d5656ffb8c54a1f1d51dc4b55068514dff7b2811465ca3f703b18747305e20c3d615afcfb26b54ea6fcfe4ebabd6febdad
SSDEEP 3072:avTN4WAUVaTFA3yHY7RkX/kSMM2GoJtg6apkSPThiQbCywOv7K:avT2WzaTFAZ7RkMSwGKt6RPtiQbxt2
TLSH
T11B046B53B2B010D8E97BC0BC86B6961AE6B270111314D7EB4794C3B32F53EE56E7AB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\javaw.exe
Size 49KB
SHA256 0d0448174d811b743faed2c1600b6174f33e65506e196b177effe0cd7a04cdb2
MD5 dc36928c52e0ddffff7445a147de3777
SHA1 169289ff76c8c39c49344d7782d04d49be2dd13b
SHA512 5a0a5c1a473831d6035f75a1edc9309a6d6b17c095cf607dae3390c8bb4a0512f99c0061bf9a9610e275beb05cb0d05648fd0c3494348999f21433b791641d8d
SSDEEP 768:hgKzx2JM5R2TyJ5R3s8D/bkt5Ruz3Vb36y5lYiDLk5uIvrP:qKzEM5RdJ5R3sozkt5RA36y5l7lIvL
TLSH
T16D337C47AE082C81F42F88F158A6752615B4BD032BD163FBBDC6B21E0D71391A9276DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\jimage.dll
Size 33KB
SHA256 8123408896077c9fcdcb0d5809d5bdf6e96a3e3a1a15bec2dc7432f68b42acf4
MD5 ab5c5bc5323ff54e4abd592d9a0c9c1c
SHA1 3f68fbd319c77eb8552f7d52e2dfa9d66e0e2399
SHA512 30a03cfb414e08a1260de5c6b873b0d0e73b3ab8aff94324523237ed53e5a67d770ea2f3d4cda669919b6ba3ec011b726b0e29c9a348a464a56a228c21775b2b
SSDEEP 384:r55kBR2x3tCn9LD+YuNIpsByvh7GBmBNyEIYi2mL4/y8RbIIvZgZ2dm:rFHCnFDCIpsIvh7L+YiDLk5uIvxm
TLSH
T137F27D5AE6841C89E927E438D4AB9A1FE7F2F9524F51C3CB1720815E0F333813B69792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\jli.dll
Size 87KB
SHA256 1e189c727f043e924cb8779b673702ba836faa7c9e752e2743b69cde70a2c1fb
MD5 16f5214869501fdb6ed2a788185dcdb5
SHA1 5c4d54a97111a47edc4c80863b4550d9d77d2035
SHA512 4cff432682afca40cbe43562c7780ebd8d8377411a6ae85bde05624a23c8c12b5b9afd79242fe442abb47f3cf095d7f4dbad35d42a4aa633793173a0f2e754f3
SSDEEP 1536:Hamt/822Yaqd9/MoU4XTZA+DyzdQIOPQ9BtG3aSq7lIvd:dt6qdzZu+2zIPQ9BgKSqOvd
TLSH
T16B938E9713E011E1DEB7D578D9B4960BC3F2F0522B61838F136885AA0F636623E1DBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\net.dll
Size 58KB
SHA256 da8fe694d71e287cb1c74d478d8854f55d6ea26aba17e58050b772a0a7ef79d8
MD5 a6d4a08b8776fc3b29893b93045319ba
SHA1 ab9d159042d71a8981ca08d6970dca1244bd9213
SHA512 2c8df49934e6dee44b16d8d9fab8ec5bd3f5c7a242bf8490b7ceab649b153a1156807bf6c52973b738b5c0757f2c7c928bed72ad16b5147fcc8d2f67eac40037
SSDEEP 1536:5rBn2bLBxyvTtPnhv5aw+YwT2e+IUmXKKPn7lIvO:XnMevxl5aLpf+IUm6KPnOvO
TLSH
T122436D0597D454D4F867CA7886A74E16DBB2B470225087DF1378C56EAFE73B23B29380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\nio.dll
Size 78KB
SHA256 50cddbcea627390ed9dee80da7ca9d1942c4c7b1e3f138276693d487a6dd589c
MD5 02d6ea954bab92b5fff6bf6360977c4d
SHA1 b130b43bd02285ddf3835935c9ffe4f2db30d11c
SHA512 3b1d594def58ce579e36b5f0607cf933a8658ea283ebe26aa33b6a8971e6af8e7f13f04b14a1d999f7bf7da1a99ca6a2cd3505d0f99de79279b5b165fe872327
SSDEEP 1536:zuKDrKVqEiWtCnNXHlJ4OzuwcTNOaRHpiys6hD27lIv9:zuKDuVqaMN3lJhXE3RHpi1eD2Ov9
TLSH
T1C17329A343A4889BE86AB538425A4747E733FC114510A75F5368CB659F1F2B33E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\server\jvm.dll
Size 13.3MB
SHA256 3df13bd73c7dbeef26693cef664b4ede84649720f7a12f0203215a65656d25f4
MD5 9499ba688fc7119fcd6f1ae2328afef8
SHA1 ac4a922693f221cd80d6bcc2d29d6a47fe447a36
SHA512 19550f2df0703ee7e2c7d1f1337248fd6455c341282965eaaa31f5877714b49a26d65309e919067bf95b64e07a375b084b6587daf1bb3f727a9c7cf93ed7f130
SSDEEP 393216:p2BHL1WWxRXvIVZwHbvxXKQTT+w9Q4kiKPZBCCb+7zErv18K35t5YJGTOIqSQW+K:w3W
TLSH
T10FE66B17A77840E1C06BD179CA97AD0BD3F2B4944331A7CB51A016ADAF67FE2193E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

turbojpeg.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\turbojpeg.dll
Size 841KB
SHA256 0f72d216b7c7816e552f50ad594c3daaf7ff16074722d073e3b246f04f85e877
MD5 ce4c416fb699f37e2125fd12b824ca67
SHA1 662deacc20f3b417b8ed4ee9b10e4956f94081f4
SHA512 c33c0e89843786fe1611258d14b25cc82ae9a8607126d846acf43f6c0baaa61b953734c684f0f55d766303ca9a3aad7bf94a64674db029adec6605e8f73c8f0e
SSDEEP 6144:2wwnt/INAkrHzhO0bnChQ7JEdhLk3tIASWGwYB6nDtqRkopRLBmko6WqUpdtZE1t:XyhUsr1bUCPHhGAgMcwzCsrG
TLSH
T1C7050703A2652C9FCBD68074CF6EC435D771382D47F346B731956AEA3A336E035AAA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\verify.dll
Size 53KB
SHA256 dd1d4af0d2c1348f29a143c358922be9d071addbf0d103d15910332cf3b74a58
MD5 e9fe8aceeea4b9adb01172354bb1edc8
SHA1 c5d3dc4e5d37b376b3173892631c2b56c70ee0c5
SHA512 23add4c23ddc206b0afe689411de04107e8c4c52b3cebfe1874d2372de824cd419a7228d9342a9e5b956f4dae7701fb52b94ad14cf6d51a63083a771c9ca1374
SSDEEP 768:4/CLyeM3rBXI38xzmjNSbYpviCCu+pXr5KZ6We2b5PM2D1qJYiDLk5uIvvU:8CU7O38d3bIRCu+Z5QDbdM2BqJ7lIv8
TLSH
T16D336B5792640476E483C638C663AEEBDBF1F4450B0083CB525487DD3F97BA0AB257AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\bin\zip.dll
Size 85KB
SHA256 a9ae352e10a098403f497ea69442818be1148a737792a21a7d568a4836d2dc06
MD5 42206886971420feb25f7c246c4b9df3
SHA1 32f64cab00db08a428f03d4238661a5d1d01bc7d
SHA512 4aec7eb7aba3b47c5cf6ef1e03e475462feef532dca7d45f9cb4210877bd2d7c690a80281b9780118f403a0d2d46367f5364e97eb6efded791cf29644d2cebae
SSDEEP 1536:eWXMxC9p/oorxZtRi58KSUXbIOxgljJ2y7lIvP5:eWXMxC9p/Nr48IxgNJ2yOvx
TLSH
T12783AE959AA05051DAFB95B0C9F34B6ED3B9B04553A147CFA358836A2F532213F0C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\conf\logging.properties
Size 2KB
SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
MD5 0f00ec3e7a7767a4efeae1875fb5f3d4
SHA1 167808418571e9209b952188ddab2f4e62920e68
SHA512 e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504
TLSH
T13B51EE5EAB4E2D35434E00AA5A7FF6527E1898BC1C23A5F6B35E6304711D83485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\conf\net.properties
Size 7KB
SHA256 56dd1f6095c189c1052f6baa32e457efc09de4832e19cdb82bb236dc8abfee9f
MD5 0c091bb338f924911db463aec454ba8b
SHA1 69e86a02207c1126a0d9faf9362a8d1798b140ad
SHA512 d0d257c7b0fc6059faef88603c07a9e1cfe6692359eb634b3436a02723ff015d36d523e1c2a252649db7cd4d0e24be114c042e3e209ce027ee07b7816466109c
SSDEEP 192:/LVGG4f4z346et5m27SnCgTe93hf7k9SrnF:ZGxYCUCgY3hzk9+F
TLSH
T1DAF17283BF46B7354399C291E21EA7EEE32C913C5C3375B831AC850D2619C76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\conf\security\java.security
Size 71KB
SHA256 7eff0eef66774d0c6a07f6c69fae02d8a7dff9b2ef3d7751af9af87a4dda33e6
MD5 20ffb7871b57243e82d798b265a429f9
SHA1 f6582cd24bc26c2f0cc85cfa9dd03ba5c308287e
SHA512 20c251ba71f0ee417131150100df3eae06f861f02a08f442770a6a742a8152337ad2a96da892a47f137b584ec195b280e683afd80d0d95a00fe41ff7b329e456
SSDEEP 1536:r+My8Si8MRjJPFp5/jTNHu1UoQ2k/gl0ugzYilNndOc98:v8MfPFD/jTNO1UoQDciDndOcm
TLSH
T14663D422BB896B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\legal\java.prefs\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\legal\java.prefs\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\legal\java.prefs\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

fontconfig.bfc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\lib\fontconfig.bfc
Size 4KB
SHA256 c7e2e76b908cb6330823e698889943c162e9861a4575501cbb59c9b830158ab0
MD5 9e80af78b019e2e52287108b50f6cfbf
SHA1 a297f3d435fab11aa3f0fd21eb2666a3ba1340ec
SHA512 b920a3e25e24a9c20d671e8a8520db2e783a5e18c695e46f7ff3851d7931711a73b97deef27c14a766ae6ed5a5519070421e5834da6200fcb6e7371b90b50e6c
SSDEEP 96:oI1KH1oTSNolnCBj7BFBBOPi+XdaWzbssHyad7pm:11Eo+gK5bBEi+xzosxi
TLSH
T1A0A1D040E9FB5308F2F3FB7696B5445A8D63BC56B7B7CA5C1010412E1B626404E12F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\lib\modules
Size 35.8MB
SHA256 33c57e3d097a57ac1defe14be4b1ecc0f070b224d68dba12168912b2cc3c160b
MD5 29a9e299da1cb880c7b9b2f4f0942865
SHA1 b35ecbc176acfae22d1113fc80a78cbfac35c79b
SHA512 14199a48158b706540c3c181572bef1a1f9203c5552302c68203a0a837c2727f1fcde7a93cb101823f1bc862e4b6469d17e4a5dabfc489eedd9ec707794febdc
SSDEEP 786432:XWH4NNhHNbN8xJ7COqiXPk/iLhyPzw7JOLDqtAlXIE:QgNHbzjyV6D+nE
TLSH
T14487220EB8C38B51C4AA913B8522A5C96771A0E4FE85078F5081721E7CB7A63D77F4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\lib\security\cacerts
Size 149KB
SHA256 98d34a90fca2688ef5674862d2a484e09e5ca25d2f07c5d654aa28f1581f3419
MD5 14ba18eba1ec1f514421a21b644d9fb1
SHA1 d16a7c7186e57094ff9bad426c048f94c6f0d0e6
SHA512 ab7355fa51a0d0c9488199dec5fbba2b365087b0427dc08be0e9ee6e7dd0254d309bd108512e0afb4167ce5ad6381abcda88ae173849ff07af26b40e37cb11a0
SSDEEP 3072:7CW6brdYD+xDlAwjhShvDZKSCgsQyAQpNYFVp/JKtwnGlaIVG6lmXPBTiM93uN/5:2W6uD+liTmqgrQ5TDur7VVJ25pG
TLSH
T118E34A4A9F7D2408BFF29F0495D8DA27AD72BBE22D59D92B101080DD1961F90BC9833F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\lib\tzdb.dat
Size 100KB
SHA256 5906b44e25a8a730131d7ba1beb5d15af27043f6536f1a169ca8a5d8b8bed8f8
MD5 1c666dde9e9c6fe77715e29d61960af2
SHA1 b6df03d1b9231bdce9ee6f5a3eeac881994f5f1a
SHA512 2a015071df1b3eaf6f5ce1c15989c874c48ca1f4818e3a24b650151292945e70b07b43baf0dad72828621a5748b8276b3ac7c17dbf0768b1881a30dd140daf2c
SSDEEP 1536:y0ExeF88hPdr92L674jAGubqn0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:yPeq8hPdrcWzbqn0hJzdxuT/5ToU
TLSH
T16AA3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\lib\tzmappings
Size 21KB
SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
MD5 4c30d7867505379a18a27d0e8f03198c
SHA1 0cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA512 873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGic3yzA6bbAdOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+qAa9W
TLSH
T1CDA25386B06662D4C073EC0D7B527AD3F886F3C899C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WebCache\jre\release
Size 221B
SHA256 6e00c90b1949bcd5df01e56158147205677cdc5f0c82cdeb12de5c9029f33df0
MD5 477fbcd362c61810e4c1aa7cd2da3389
SHA1 5976c74380c95eb52906bc1bcb224750ed4d3c85
SHA512 e30b2f4caadb0ad7ee43797c110daeb2c5efcec4107d5a293e156c3ae2d2213e4b509ebdb72e8800b0b42f889e41cf29c2b5f914d901f1fbb9ed5d405d15a7fc
TLSH
T164D0A76F541A50D198A051D014694C0EF8E9E830474458C056875540213265832B172B
MD5 SHA1 SHA512 TLSH

Submit Download

jna16777354429904436089.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna16777354429904436089.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-unknown-1227725b-1449-41b4-9d69-42a4a39b3aeb-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-unknown-1227725b-1449-41b4-9d69-42a4a39b3aeb-sqlitejdbc.dll
Size 989KB
SHA256 7d3281c7adbf3d2fe6b07462dee9cb310194c302154175f172ced3aac05c91c3
MD5 e7c071298e8dee127cb4613a0a8153b1
SHA1 cf369422e3f33057458c6f4e0b55946d758c7f9a
SHA512 678000dc852fe881371a24faa89876c59fc0dc90425a124c761551b5d245c794c3f22f9a4485ae877db2a45c0da3c7675358f518fef62868bc33e896469b3cbc
SSDEEP 24576:BiuvJKYR7AysTtevOn5rDpep8VMaLH/qN7M4UR:5B1nsTtTn55A8+UfqNpU
TLSH
T1A4255C13E39244FDC47BC2B0871FA363B632F4493134AA4F6AA48B692E15E60D75F758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_3fe4c0bd-0c39-4e42-82e4-81a77ab6790a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2757962786-3770611029-2102435697-1000\83aa4cc77f591dfc2374580bbd95f6ba_3fe4c0bd-0c39-4e42-82e4-81a77ab6790a
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/4724-897-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-911-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-906-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-908-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-904-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-903-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-609-0x000001F6BBE30000-0x000001F6BBE59000-memory.dmp

Download

memory/4724-905-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-831-0x00007FFF3BAE0000-0x00007FFF3BBE0000-memory.dmp

Download

memory/4724-551-0x000001F6BBE20000-0x000001F6BBE2E000-memory.dmp

Download

memory/4724-913-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-604-0x000001F6BBE30000-0x000001F6BBE59000-memory.dmp

Download

memory/4724-608-0x000001F6BBE30000-0x000001F6BBE59000-memory.dmp

Download

memory/4724-912-0x000001F6DEFD0000-0x000001F6E1441000-memory.dmp

Download

memory/4724-611-0x000001F6BBE30000-0x000001F6BBE59000-memory.dmp

Download

memory/4724-610-0x000001F6BBE30000-0x000001F6BBE59000-memory.dmp

Download

memory/4756-681-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-722-0x0000018BDF780000-0x0000018BDF7B0000-memory.dmp

Download

memory/4756-168-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-155-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-146-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-68-0x0000018BBC9E0000-0x0000018BBCA09000-memory.dmp

Download

memory/4756-69-0x0000018BBC9E0000-0x0000018BBCA09000-memory.dmp

Download

memory/4756-663-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-671-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-672-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-675-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-673-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-676-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-677-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-488-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-684-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-690-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-691-0x0000018BE0500000-0x0000018BE2971000-memory.dmp

Download

memory/4756-714-0x0000018BDF780000-0x0000018BDF7B0000-memory.dmp

Download

memory/4756-721-0x0000018BDF780000-0x0000018BDF7B0000-memory.dmp

Download

memory/4756-720-0x0000018BDF780000-0x0000018BDF7B0000-memory.dmp

Download

memory/4756-719-0x0000018BDF780000-0x0000018BDF7B0000-memory.dmp

Download

memory/4756-718-0x0000018BDF780000-0x0000018BDF7B0000-memory.dmp

Download

memory/4756-160-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-745-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-70-0x0000018BBC9E0000-0x0000018BBCA09000-memory.dmp

Download

memory/4756-71-0x0000018BBC9E0000-0x0000018BBCA09000-memory.dmp

Download

memory/4756-64-0x0000018BBC9E0000-0x0000018BBCA09000-memory.dmp

Download

memory/4756-25-0x0000018BBC9D0000-0x0000018BBC9DE000-memory.dmp

Download

memory/4756-828-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-196-0x00007FFF2ACD0000-0x00007FFF2ADD0000-memory.dmp

Download

memory/4756-837-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-843-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-195-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-209-0x00007FFF2ACD0000-0x00007FFF2ADD0000-memory.dmp

Download

memory/4756-208-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-212-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-218-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-220-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-224-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-231-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-236-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-925-0x00007FFF2ACD0000-0x00007FFF2ADD0000-memory.dmp

Download

memory/4756-924-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-933-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-936-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-939-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download

memory/4756-942-0x0000018BBB460000-0x0000018BBC202000-memory.dmp

Download