adwind | 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019

Resubmissions

07/10/2026, 08:17

261007-j649zaws6l10

07/10/2026, 08:09

261007-j2dlfsv17l10

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe.jar
Size 570KB
Sample261007-j2dlfsv17l
SHA256 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019
MD5 31f90d8a8a473074bfeef7972d5a39b2
SHA1 083a3c0e8c33f1ea8d0f59f76e8e82a6871aebdd
SHA512 bc8abbfba825303e38ed4a29d72af2a1f6d54592a14e53807defb0d24326ab540645e7b69f4fe5b79e9e3bb4dc10e5fda0281e852443700feea512db7654dc68
SSDEEP 12288:JME6KYOW/U7JA1T7hyiGuwtjXOi8KyI/qroUIRMZNmkq0pT8Kiy4:3YOAU1A1pULOi8Ky4qrohMZNuET8D
TLSH
T115C41207FEE8843DE8338A349D93D0727D462DED9C2A916B58560AD04A64C6F8F274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution adwind persistence trojan

Malware Config

Signatures

Family: AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

JAR file contains resources related to AdWind 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c710-202.dat	family_adwind1

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCDBlog.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff_x64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWatchDog.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient_Diagnostic_Tool.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filwscc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYSSER.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusutilities.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NS.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NS.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAPISSVC.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIEWTCP.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnf.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSvcHost.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldRTM.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDKBFltExe32.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QUHLPSVC.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiUpdateTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldDS.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebCompanion.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7AVScan.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSUpdate64.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiSeAgnt.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavWebClient.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiFW.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quamgr.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dragon_updater.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSHDLL64.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldRTM.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreServiceShell.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserReg.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe\debugger = "svchost.exe"	regedit.exe

Executes dropped EXE 2 IoCs

pid	Process
3352	javaw.exe
5520	java.exe

Loads dropped DLL 24 IoCs

pid	Process
3352	javaw.exe
3352	javaw.exe
3352	javaw.exe
3352	javaw.exe
3352	javaw.exe
3352	javaw.exe
3352	javaw.exe
3352	javaw.exe
3352	javaw.exe
5520	java.exe
5520	java.exe
5520	java.exe
5520	java.exe
5520	java.exe
5520	java.exe
5520	java.exe
3352	javaw.exe
5520	java.exe
5520	java.exe
3352	javaw.exe
5520	java.exe
5520	java.exe
3352	javaw.exe
5520	java.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\NYRZDOmEJZd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\xmpCzqQrOmL\\LPZiwaCeIRf.jcCGXp\""	reg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs

execution

Visual Basic

T1059.005

pid	Process
4624	cscript.exe
5856	cscript.exe
1048	cscript.exe
2640	cscript.exe
3604	cscript.exe
3396	cscript.exe
3704	cscript.exe
4620	cscript.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3056	cmd.exe
5832	cmd.exe
6104	cmd.exe
2820	cmd.exe
2012	cmd.exe
5256	cmd.exe
2768	cmd.exe
5712	cmd.exe
4084	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4884	taskkill.exe
4412	taskkill.exe
1228	taskkill.exe
5636	taskkill.exe
3720	taskkill.exe
5812	taskkill.exe
2976	taskkill.exe
844	taskkill.exe
4908	taskkill.exe
5008	taskkill.exe
2544	taskkill.exe
3876	taskkill.exe
3832	taskkill.exe
824	taskkill.exe
5604	taskkill.exe
5248	taskkill.exe
5928	taskkill.exe
4260	taskkill.exe
5668	taskkill.exe
3880	taskkill.exe
5072	taskkill.exe
3508	taskkill.exe
3476	taskkill.exe
2780	taskkill.exe
5504	taskkill.exe
1428	taskkill.exe
2680	taskkill.exe
5608	taskkill.exe
4352	taskkill.exe
2976	taskkill.exe
4424	taskkill.exe
5984	taskkill.exe
5424	taskkill.exe
1612	taskkill.exe
3268	taskkill.exe
2040	taskkill.exe
6132	taskkill.exe
4976	taskkill.exe
3156	taskkill.exe
2580	taskkill.exe
4396	taskkill.exe
1312	taskkill.exe
4664	taskkill.exe
4820	taskkill.exe
1720	taskkill.exe
4092	taskkill.exe
812	taskkill.exe
6040	taskkill.exe
3936	taskkill.exe
1544	taskkill.exe
3136	taskkill.exe
1808	taskkill.exe
5740	taskkill.exe
4164	taskkill.exe
3816	taskkill.exe
412	taskkill.exe
6056	taskkill.exe
3484	taskkill.exe
1816	taskkill.exe
4260	taskkill.exe
2216	taskkill.exe
3412	taskkill.exe
4420	taskkill.exe
2684	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3452	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
5208	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	5812	taskkill.exe
Token: SeDebugPrivilege	5676	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	3488	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	5248	taskkill.exe
Token: SeDebugPrivilege	3316	taskkill.exe
Token: SeDebugPrivilege	812	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	1388	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	6072	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	3612	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	5504	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	440	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	3136	taskkill.exe
Token: SeDebugPrivilege	3472	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	2176	taskkill.exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	3292	taskkill.exe
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	5172	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	368	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	3156	taskkill.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	4820	taskkill.exe
Token: SeDebugPrivilege	412	taskkill.exe
Token: SeDebugPrivilege	3508	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	824	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	1228	taskkill.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	5996	taskkill.exe
Token: SeDebugPrivilege	3244	taskkill.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3304	java.exe
4508	java.exe
3352	javaw.exe
5520	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4508	3304	java.exe	90
PID 3304 wrote to memory of 3056	3304	java.exe	92
PID 4508 wrote to memory of 5832	4508	java.exe	94
PID 3056 wrote to memory of 2640	3056	cmd.exe	96
PID 5832 wrote to memory of 1048	5832	cmd.exe	97
PID 3304 wrote to memory of 6104	3304	java.exe	98
PID 4508 wrote to memory of 2820	4508	java.exe	100
PID 6104 wrote to memory of 3604	6104	cmd.exe	102
PID 2820 wrote to memory of 3396	2820	cmd.exe	103
PID 3304 wrote to memory of 2564	3304	java.exe	104
PID 4508 wrote to memory of 2488	4508	java.exe	106
PID 4508 wrote to memory of 2732	4508	java.exe	108
PID 3304 wrote to memory of 3560	3304	java.exe	110
PID 3304 wrote to memory of 3452	3304	java.exe	112
PID 3304 wrote to memory of 2620	3304	java.exe	113
PID 3304 wrote to memory of 812	3304	java.exe	114
PID 3304 wrote to memory of 3352	3304	java.exe	118
PID 3352 wrote to memory of 5520	3352	javaw.exe	119
PID 3352 wrote to memory of 2012	3352	javaw.exe	121
PID 2012 wrote to memory of 3704	2012	cmd.exe	123
PID 3352 wrote to memory of 5256	3352	javaw.exe	124
PID 5256 wrote to memory of 4620	5256	cmd.exe	126
PID 5520 wrote to memory of 4084	5520	java.exe	127
PID 4084 wrote to memory of 4624	4084	cmd.exe	129
PID 3352 wrote to memory of 1928	3352	javaw.exe	130
PID 5520 wrote to memory of 2768	5520	java.exe	132
PID 2768 wrote to memory of 5856	2768	cmd.exe	134
PID 5520 wrote to memory of 5188	5520	java.exe	135
PID 3352 wrote to memory of 5864	3352	javaw.exe	137
PID 3352 wrote to memory of 5712	3352	javaw.exe	138
PID 5712 wrote to memory of 5208	5712	cmd.exe	141
PID 3352 wrote to memory of 5812	3352	javaw.exe	143
PID 3352 wrote to memory of 5676	3352	javaw.exe	145
PID 3352 wrote to memory of 4584	3352	javaw.exe	147
PID 3352 wrote to memory of 3488	3352	javaw.exe	149
PID 3352 wrote to memory of 2976	3352	javaw.exe	151
PID 3352 wrote to memory of 5248	3352	javaw.exe	153
PID 3352 wrote to memory of 3316	3352	javaw.exe	155
PID 3352 wrote to memory of 812	3352	javaw.exe	157
PID 3352 wrote to memory of 1312	3352	javaw.exe	159
PID 3352 wrote to memory of 1988	3352	javaw.exe	161
PID 3352 wrote to memory of 4412	3352	javaw.exe	163
PID 3352 wrote to memory of 1388	3352	javaw.exe	165
PID 3352 wrote to memory of 5928	3352	javaw.exe	167
PID 3352 wrote to memory of 2216	3352	javaw.exe	169
PID 3352 wrote to memory of 6072	3352	javaw.exe	172
PID 3352 wrote to memory of 1152	3352	javaw.exe	174
PID 3352 wrote to memory of 3612	3352	javaw.exe	176
PID 3352 wrote to memory of 1148	3352	javaw.exe	178
PID 3352 wrote to memory of 4280	3352	javaw.exe	180
PID 3352 wrote to memory of 4664	3352	javaw.exe	182
PID 3352 wrote to memory of 5504	3352	javaw.exe	184
PID 3352 wrote to memory of 4976	3352	javaw.exe	186
PID 3352 wrote to memory of 440	3352	javaw.exe	188
PID 3352 wrote to memory of 1544	3352	javaw.exe	190
PID 3352 wrote to memory of 3832	3352	javaw.exe	192
PID 3352 wrote to memory of 5044	3352	javaw.exe	194
PID 3352 wrote to memory of 1612	3352	javaw.exe	196
PID 3352 wrote to memory of 3136	3352	javaw.exe	198
PID 3352 wrote to memory of 3472	3352	javaw.exe	200
PID 3352 wrote to memory of 972	3352	javaw.exe	202
PID 3352 wrote to memory of 1808	3352	javaw.exe	204
PID 3352 wrote to memory of 2176	3352	javaw.exe	206
PID 3352 wrote to memory of 4260	3352	javaw.exe	208

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2620	attrib.exe
812	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe.jar
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.57296491388333354948483762850048474.class
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5340480331395759806.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5340480331395759806.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:1048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3153021052412761494.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3153021052412761494.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:3396
- - C:\Windows\SYSTEM32\xcopy.exe
    xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
    3⤵
    PID:2488
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:2732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8447551086751971751.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8447551086751971751.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:2640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive819177478956824342.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive819177478956824342.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:3604
- C:\Windows\SYSTEM32\xcopy.exe
  xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
  2⤵
  PID:2564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:3560
- C:\Windows\SYSTEM32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NYRZDOmEJZd /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3452
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\xmpCzqQrOmL\*.*"
  2⤵
  - Views/modifies file attributes
  PID:2620
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\xmpCzqQrOmL"
  2⤵
  - Views/modifies file attributes
  PID:812
- C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
  C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
    C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.6297580644787873340679149667712580.class
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6864458310108585406.vbs
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4084
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6864458310108585406.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:4624
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8882376635640777542.vbs
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8882376635640777542.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:5856
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:5188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive762028916948500805.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive762028916948500805.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:3704
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6264110122521278312.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6264110122521278312.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:4620
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:1928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM UserAccountControlSettings.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\TMjdKlYrwN8392608174235098066.reg
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\TMjdKlYrwN8392608174235098066.reg
      4⤵
      UAC bypass
      Event Triggered Execution: Image File Execution Options Injection
      Runs .reg file with regedit
      PID:5208
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Taskmgr.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ProcessHacker.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5676
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM procexp.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MSASCui.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MsMpEng.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MpUXSrv.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MpCmdRun.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM NisSrv.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ConfigSecurityPolicy.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM procexp.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM wireshark.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM tshark.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM text2pcap.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM rawshark.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mergecap.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM editcap.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM dumpcap.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM capinfos.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbam.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbamscheduler.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbamservice.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareService.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM WebCompanion.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareDesktop.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Main.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Svc.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Up.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3SP.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Proxy.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Medic.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BgScan.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuard.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuardBhvScanner.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuarScanner.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM LittleHook.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuardUpdate.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM clamscan.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ClamTray.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ClamWin.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cis.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM CisTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cmdagent.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cavwp.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:368
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM dragon_updater.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MWAGENT.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MWASER.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM CONSCTLX.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5608
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM avpmapp.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM econceal.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:412
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM escanmon.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM escanpro.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM TRAYSSER.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM TRAYICOS.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM econser.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM VIEWTCP.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSHDLL64.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fsgk32.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fshoster32.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSMA32.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fsorsp.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fssm32.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSM32.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM trigger.exe /T /F
    3⤵
    PID:1388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FProtTray.exe /T /F
    3⤵
    PID:4976
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FPWin.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3876
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FPAVServer.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4420
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVK.exe /T /F
    3⤵
    PID:4204
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GdBgInx64.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5668
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKProxy.exe /T /F
    3⤵
    PID:5564
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDScan.exe /T /F
    3⤵
    PID:2588
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKWCtlx64.exe /T /F
    3⤵
    PID:2156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKService.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1428
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKTray.exe /T /F
    3⤵
    PID:4152
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDKBFltExe32.exe /T /F
    3⤵
    PID:2436
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDSC.exe /T /F
    3⤵
    PID:2140
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM virusutilities.exe /T /F
    3⤵
    PID:1180
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM guardxservice.exe /T /F
    3⤵
    PID:3332
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM guardxkickoff_x64.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:6056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM iptray.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5636
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM freshclam.exe /T /F
    3⤵
    PID:2044
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM freshclamwrap.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3720
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7RTScan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3484
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7FWSrvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7PSSrvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7EmlPxy.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:2684
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSecurity.exe /T /F
    3⤵
    PID:4272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7AVScan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5740
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7CrvSvc.exe /T /F
    3⤵
    PID:3164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7SysMon.Exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMain.exe /T /F
    3⤵
    PID:1388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMngr.exe /T /F
    3⤵
    PID:2208
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nanosvc.exe /T /F
    3⤵
    PID:1176
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nanoav.exe /T /F
    3⤵
    PID:1832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nnf.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvcsvc.exe /T /F
    3⤵
    PID:3732
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nbrowser.exe /T /F
    3⤵
    PID:3016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nseupdatesvc.exe /T /F
    3⤵
    PID:4360
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nfservice.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1720
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nwscmon.exe /T /F
    3⤵
    PID:2640
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM njeeves2.exe /T /F
    3⤵
    PID:4864
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvcod.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:6132
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvoy.exe /T /F
    3⤵
    PID:468
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM zlhh.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Zlh.exe /T /F
    3⤵
    PID:1432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nprosec.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4884
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Zanda.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2680
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM NS.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM acs.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM op_mon.exe /T /F
    3⤵
    PID:1664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSANHost.exe /T /F
    3⤵
    PID:4280
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSUAMain.exe /T /F
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSUAService.exe /T /F
    3⤵
    PID:2276
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AgentSvc.exe /T /F
    3⤵
    PID:2156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BDSSVC.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:5608
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM EMLPROXY.EXE /T /F
    3⤵
    PID:276
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM OPSSVC.EXE /T /F
    3⤵
    PID:1504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ONLINENT.EXE /T /F
    3⤵
    PID:1036
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM QUHLPSVC.EXE /T /F
    3⤵
    PID:4352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SAPISSVC.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:4396
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SCANNER.EXE /T /F
    3⤵
    PID:4348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SCANWSCS.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:5984
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM scproxysrv.exe /T /F
    3⤵
    PID:4188
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ScSecSvc.exe /T /F
    3⤵
    PID:712
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SUPERAntiSpyware.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3936
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SASCore64.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3880
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SSUpdate64.exe /T /F
    3⤵
    PID:5292
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SUPERDelete.exe /T /F
    3⤵
    PID:2828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SASTask.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7RTScan.exe /T /F
    3⤵
    PID:3560
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7FWSrvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7PSSrvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5424
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7EmlPxy.EXE /T /F
    3⤵
    PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 f24b6ee54876e5b047aca265c687bcabe55618c1fdb98f6530a61585e0308a92
MD5 abe5c04647122ef1b9bc90072273c589
SHA1 073eb2f663daa421e519f54dac07e69f88b2db7c
SHA512 b33b4243a12043c039ce50cfc4fe74976bc4b4a5d0130a51e97fc7df79d4bf6475c71dc155088ee20732a370a4649e5b8c234ce46090809b456d5c9f8e339c48
MD5 SHA1 SHA512

Submit Download

50569f7db71fa7f8.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp
Size 54B
SHA256 9dce7daf717fb1c5a1ba62c649125627d0ed6e3a4359d9b32526756903bf804b
MD5 e8804c574ff2d7304ad3fd13da26746e
SHA1 0462cc7f8a262843a50eaeb305224e3fde6e8c01
SHA512 f27e84780e1b301305762511fa69101668eb58d0f27d749bd3beca4ca20f38ee0dfebf829f70ab4a594a90831f2c6f60084377f0612a91b8fa0e1c7877462b16
TLSH
T18990025441D88B1E5405806B46736049C5664A507BD5355C8B04C44CD540418E685002
MD5 SHA1 SHA512 TLSH

Submit Download

Retrive819177478956824342.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive819177478956824342.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
TLSH
T1C0D02B00D4E7C39000BED702D1E5926EB9E2010D320157487D8490FB12AA07EE5711B5
MD5 SHA1 SHA512 TLSH

Submit Download

Retrive8447551086751971751.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive8447551086751971751.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
TLSH
T12ED02B0094E3C35000BE970290E9662EF9A2020D32015B487D4450F3222E0BEEAB15B5
MD5 SHA1 SHA512 TLSH

Submit Download

TMjdKlYrwN8392608174235098066.reg

Path C:\Users\Admin\AppData\Local\Temp\TMjdKlYrwN8392608174235098066.reg
Size 27KB
SHA256 9613caed306e9a267c62c56506985ef99ea2bee6e11afc185b8133dda37cbc57
MD5 7f97f5f336944d427c03cc730c636b8f
SHA1 8a50c72b4580c20d4a7bfc7af8f12671bf6715ae
SHA512 8f8b5dc16f087bdc73a134b76fd1063765e3c049baca4873d1b9eb30ba59f418395490cafc78a93b1cdcc20461e73c96de34475669715d6ddb93d0b56e6e6c54
SSDEEP 96:PJWwXczWquqtVcUtABCtmtatLitmtJCtTt6tVtatNtgtitCtztHtxtMt8thtVRtl:Pqg2nuR0hTmEgGpF
TLSH
T1B3C22A508A35433592F274948646AC523F7E533E7247ABA964C8D01DB3A1B9BC29F3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_0.57296491388333354948483762850048474.class

Path C:\Users\Admin\AppData\Local\Temp\_0.57296491388333354948483762850048474.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
TLSH
T1E634F10DFBAD84A5DBE6203042D644C6A7752E94E3C184738DB6726343B5E73DA23AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_33176972-d8ee-4ba0-852e-00e5d12a8933

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-560646293-820748483-2532804640-1000\83aa4cc77f591dfc2374580bbd95f6ba_33176972-d8ee-4ba0-852e-00e5d12a8933
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
Size 1.3MB
SHA256 6d1c82cad959b7e4636d8fced4368f0f2c8da4ef609667396e8772ad8d63f736
MD5 39a3de251306cbca47cf2fb10089ae9f
SHA1 cc3f3d1bc3ad172c9646961b18fe1d7bf98b59a5
SHA512 351a02453659d04a2943abc1da2b9541f97982ed3f94d288679dfd8d962bfb4b0dcdef9b06d329bdad64e032b0372733ff7d1577c49952accf86b971aed86f7e
SSDEEP 24576:or19iF8DpwAZGFCFcbtv5nHSaELVPwtDi6MDO6aBN1VWgerlE6:6XiF8tpGFJHwVoY6MDO6aBN1cLf
TLSH
T1BB658D07F3944095D66FA4B4C29B521FE7B2B419030097EB32B19B6EBF67BE06239345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
Size 162KB
SHA256 179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54
MD5 4e6dfd5867f4cea96dad1d59a0ca43fe
SHA1 6a08abc0b5a2cab00eb6d7543c661aa6620890a1
SHA512 2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b
SSDEEP 3072:dgpGH1/rHpcDJ0oL9JLVZcRysrS7DgWw2xM:Wpg0TZHQh
TLSH
T170F32947A3524092F457B6B8B12A000BF376B465032C92EB43E58BAE5FAF7317D47794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
Size 285KB
SHA256 af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e
MD5 dafb5fbb0614c19eccdab9bef8f89c22
SHA1 91ab91eb4a90f02c4950c3e5da80f3eb24bddb52
SHA512 81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93
SSDEEP 3072:5LBM1lpzb9ydKHsz1//3H+ktNNWo7vNnParlMhubG0XqkwnJEszNvarvcLPYDJ67:pWPZw225bN5zFEjGkqkAJHyEzYV/PvyX
TLSH
T17B549E95B3901CF8EC67813EC9558906D6B27C5A0B70C65F03A436675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
Size 285KB
SHA256 a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef
MD5 7fb44c5bca4226d8aab7398e836807a2
SHA1 47128e4f8afabfde5037ed0fcaba8752c528ff52
SHA512 f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab
SSDEEP 6144:PAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhD:PCd9/WYoaLHF3z0z04PDvhD
TLSH
T142548EA5B3901CF8EC67813EC9558906D6B27C5A0770C65F03A836675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll
Size 44KB
SHA256 5e7fbfceaea80ff9d3691f56eba7b68a4f13f0317e7961cc0e23672952b34e1d
MD5 388b808b78870de046976fbb600662eb
SHA1 34e4ee12ce8c0b7fd0258202162c7c6f7575c9a9
SHA512 9024e63c17d903314e5f3d4fdf99c40f23d04ca0471951589e2ab679709bcc3376bfb847961cd54b949e4a684eaf13114ad338f4e3b1e6be11af10c0687da91c
SSDEEP 768:igQ8L4Pi+2LPe/0wZsW8u2FOSz+qzpIqJYifcPxWETDh:HGwC0wZ58p3z+qNIqJ7UPx7
TLSH
T121133D22676D5086F4DFB175B4910532DAB1B4D22B80938F0370C6295FBBFE27639275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
TLSH
T1FCC40927B74D02A0E195A3B861C34305D7F1BC4A8312A3C752FAD66E2F6B7D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
Size 104KB
SHA256 833cdbd7b221dda58ba728ee9a41cac1d6819d19bfc7336a4b86cc69a5af3695
MD5 6c720917e5c8ce1202a4141e8c8cfaf7
SHA1 1175d918134983d1d64a42047f4ff814054123de
SHA512 217f824b389547993556c26069d58eb956e87029b5c58556c2d308e48a0db2a02a057b3147fcf6ac7606f2b97ada33e2372112e93944f645137d81cc0dd32a9d
SSDEEP 1536:2vpp3y2kIlAYVZ+qbzKWrTcJuV618k89DmucOiG/OJY9GzNAiKyy0CLLLdx7PPxD:pYSqbzKWrTcJuGbEDmYGeifLCDdxLxD
TLSH
T1FCA35A05736824C1FC3BD2BC8586461BD7B3B4B06260939F13A6C65A6FDB7B13E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
Size 66KB
SHA256 686021b000cd6d76b97c6f924c528293bc55dfb4ce936cfe70959eecd1665c90
MD5 d8a6b5e5a33cb71b61964be369526704
SHA1 7788adf9163fb2ac2c85c43630c0998b0f13360a
SHA512 d15e5832d025a8fb17dd48b8c6d8246b93d54543ba52d40a9f97aff257847f7e05971ae927a77e12ab1625dc514a29115ce5fe9ddad18fe5fc4b0ddc2f8ca6d1
SSDEEP 768:QSwbGTKTjBFs3zdaON+ClYKaFwoqgzizndNXur2Z3/oHbg6wuZWm3w3hUjhgYi5x:olONFYKAQn7Xur20bCCJ3Khyhg75PxQ+
TLSH
T154631AB253A4489BE42AB53C429A075BF433FC508510A39F532987169B6F3B33B7D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Size 8.5MB
SHA256 6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21
MD5 dceeb4fb6af9bb2ea7a2eed1d921afb5
SHA1 af1463a499f7d6eed5efcb9c9515e82335e9c1b6
SHA512 e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763
SSDEEP 98304:OhNdNu6fLpeSRNeOhWnaC5Qu5e9kmhRVfvLP0KsH1OIueGeM1Q:OhNdNu6fLpDRwOhoaCyucC0RVfjPiHuC
TLSH
T11D966C5A927050D8DB2AC2788B17DE47E7F2F4A40770ABCB11B8434E5F17BE1297E216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
Size 142KB
SHA256 86106645d9e3801911808d6343a7fead7b6e9d8b740bad63a4cd9851ff599283
MD5 2632b6d90868ff1ece67f76b86a23d79
SHA1 90ddedde02a4cc37ae361caabc36a6a686c24bd1
SHA512 61e0581c3dde45db74383b93e56396c65435714e746fe4f000c53465e8e6750bd787b5895a987bbdbe4badb5ad3570394c82476c2b4d65099f0b923002153b18
SSDEEP 3072:2zs5pH2Lmngo9QVKTIVbheI14/QwIwS6ycf+lxhC:Cs5pWLmngo9HTMhp14Hpyc7
TLSH
T1C5E36C4732E08297C9638A31C953F55AEFB0B82576E0C37B13574A45EF23395AE2B325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
TLSH
T174936C4677A542B7D06AD278C2E35A06F770B844877063CF03B64AA94F23BE19E3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
TLSH
T16EF24B9467B88446D06B86B0C4D3AE57BE3CF9655750938F0BA4C29D1F23BD0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
Size 55KB
SHA256 9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb
MD5 82bb3a2292372acbf8bb25e30a3e169c
SHA1 c09c134561213cd67c670f60a2c52cf947e51a74
SHA512 db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7
SSDEEP 768:gGq5ZtjA9EC+mzTJaJSMR26WPI/hY5iX2N9mWKYilefjPxWEta:gGsTSP+mG726iI/hqPN9mWK7wjPxG
TLSH
T1AE436B6792A00875E087C538C5639EDBEBB1FAD51A4083CB4360C6CDBF53B51EA2477A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
Size 87KB
SHA256 27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9
MD5 0d56a7ff632826362768b3edd5e5174f
SHA1 8b96856f8fe3175039d1a7cf3ac0910467844a08
SHA512 b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595
SSDEEP 1536:d4oESIZDpOoUQ4Ps5OwVOIOQIO6nqejL8j672PxV/:d4o5IZDZUXwV8G6nqejLY6WxV/
TLSH
T1A5939D918A605561DAB799B0C9F68A2ED376B02013C497CB534CC7962F477A13F8C3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ID.txt

Path C:\Users\Admin\fUTkALeaTxM\ID.txt
Size 47B
SHA256 35f939729dc1247068580990117ef24e1ddc22cbc8088ea46edf6470c2f82cad
MD5 21238c5702a6e4b843b4c969de19e3c5
SHA1 9bdfa5ef82f0ec46d887b113f63cf744d71d13ab
SHA512 ff7fe74e4ee1a40a67ee23814f2c54661e4f485ec3f56152d2ed90c984325c400af3edbb97b6b6d971b939cc4cd7db887dd3e97e8eb541cccff675a17d7e2875
MD5 SHA1 SHA512

Submit Download

ID.txt

Path C:\Users\Admin\xmpCzqQrOmL\ID.txt
Size 47B
SHA256 662c288b93f640c9ee3c0c22f2afa171d43f4bdc86aca96ecabf71bbd8cae6bc
MD5 f4162abde9d9eb7c60fdd991597f0b6b
SHA1 38592e3ae76a5d212e50964485831c119bfb2f50
SHA512 2cb83c196f05a86cc74186a65fd9150cf6c2adf58b1d364ff101a8b54368878db13190ef4772051e220a683b835d30744ef58179430bc230e10085d6df595e47
MD5 SHA1 SHA512

Submit Download

LPZiwaCeIRf.jcCGXp

Path C:\Users\Admin\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp
Size 570KB
SHA256 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019
MD5 31f90d8a8a473074bfeef7972d5a39b2
SHA1 083a3c0e8c33f1ea8d0f59f76e8e82a6871aebdd
SHA512 bc8abbfba825303e38ed4a29d72af2a1f6d54592a14e53807defb0d24326ab540645e7b69f4fe5b79e9e3bb4dc10e5fda0281e852443700feea512db7654dc68
SSDEEP 12288:JME6KYOW/U7JA1T7hyiGuwtjXOi8KyI/qroUIRMZNmkq0pT8Kiy4:3YOAU1A1pULOi8Ky4qrohMZNuET8D
TLSH
T115C41207FEE8843DE8338A349D93D0727D462DED9C2A916B58560AD04A64C6F8F274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.txt

Path C:\Windows\System32\test.txt
Size 261B
SHA256 544793330069eb3af9db59ed033e94f234645d0ec5454e382c926c9dd973bf38
MD5 59b4db44fd6e2d134804a534b508f622
SHA1 231fa3052fcbd7cc17ab6ce13ad039e331989213
SHA512 62e41ce38d60882578152760ce570315e9392c47bfae85027d76d6cc02c6c7e880c68a4523ef59242c8668626c042305297976081e85f815f4519bc821567d6a
TLSH
T1A7D095C09D3724409B05CDEC5CB445D4D6D7607CCCDCE74816DA5B7C04972CE5BDA556
MD5 SHA1 SHA512 TLSH

Submit Download

test.txt

Path C:\Windows\System32\test.txt
Size 505B
SHA256 e55b94383811996d003bd4644389fe1c71d041de742d0801a5361cd9b06b3221
MD5 163ea494e9afa6617e7c3e34a706e06c
SHA1 efdfc8050b8b25494479a774300eb61e1d871571
SHA512 86566fa39f3b4e5c143dd0b0c5d0b82077cc989a640752a81577ea56fc77f5952bd63f84e38c08f2134dd1bf39ac9e2579f889c522a58c18ca69f58642be6a7c
TLSH
T19DF0752A113C2E1E5B2C9A2E303CB06F08126102FFC051DA9B20060001A0005B90A247
MD5 SHA1 SHA512 TLSH

Submit Download

test.txt

Path C:\Windows\System32\test.txt
Size 284B
SHA256 6fd5e60cde80ac2105378bc4ae294eb7ef86225d8253da8bf926408db69a8ba2
MD5 175672022b51e7e7de00456d2a6ee114
SHA1 28cf17abc08b6f66a9aeeab1713c5a0ae4235f3b
SHA512 1410782575a8c1daa64aaf2eb675cc835c9d381143163062f51283eb1797d1b86e10af757a31e55798f0dc835c3e628c59fd9ae130805a09e467a3ffeee86138
TLSH
T172D0EB08E5D492C0CBF144F318BBE3BCA898B27130A80E498B08848562C200B920081D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3304-147-0x000001FD28D30000-0x000001FD28D40000-memory.dmp

Download

memory/3304-186-0x000001FD28D10000-0x000001FD28D20000-memory.dmp

Download

memory/3304-72-0x000001FD28BF0000-0x000001FD28C00000-memory.dmp

Download

memory/3304-71-0x000001FD28BE0000-0x000001FD28BF0000-memory.dmp

Download

memory/3304-70-0x000001FD28BD0000-0x000001FD28BE0000-memory.dmp

Download

memory/3304-2-0x000001FD28940000-0x000001FD28BB0000-memory.dmp

Download

memory/3304-11-0x000001FD27050000-0x000001FD27051000-memory.dmp

Download

memory/3304-23-0x000001FD27050000-0x000001FD27051000-memory.dmp

Download

memory/3304-32-0x000001FD28BB0000-0x000001FD28BC0000-memory.dmp

Download

memory/3304-86-0x000001FD28CB0000-0x000001FD28CC0000-memory.dmp

Download

memory/3304-85-0x000001FD28C40000-0x000001FD28C50000-memory.dmp

Download

memory/3304-84-0x000001FD28C30000-0x000001FD28C40000-memory.dmp

Download

memory/3304-83-0x000001FD28C20000-0x000001FD28C30000-memory.dmp

Download

memory/3304-80-0x000001FD28C10000-0x000001FD28C20000-memory.dmp

Download

memory/3304-35-0x000001FD28BC0000-0x000001FD28BD0000-memory.dmp

Download

memory/3304-97-0x000001FD28C60000-0x000001FD28C70000-memory.dmp

Download

memory/3304-42-0x000001FD28C00000-0x000001FD28C10000-memory.dmp

Download

memory/3304-41-0x000001FD28BF0000-0x000001FD28C00000-memory.dmp

Download

memory/3304-94-0x000001FD28C70000-0x000001FD28C80000-memory.dmp

Download

memory/3304-93-0x000001FD28C50000-0x000001FD28C60000-memory.dmp

Download

memory/3304-108-0x000001FD28CA0000-0x000001FD28CB0000-memory.dmp

Download

memory/3304-107-0x000001FD28C90000-0x000001FD28CA0000-memory.dmp

Download

memory/3304-106-0x000001FD28CE0000-0x000001FD28CF0000-memory.dmp

Download

memory/3304-105-0x000001FD28CD0000-0x000001FD28CE0000-memory.dmp

Download

memory/3304-44-0x000001FD28C10000-0x000001FD28C20000-memory.dmp

Download

memory/3304-103-0x000001FD28CC0000-0x000001FD28CD0000-memory.dmp

Download

memory/3304-102-0x000001FD28C80000-0x000001FD28C90000-memory.dmp

Download

memory/3304-40-0x000001FD28BE0000-0x000001FD28BF0000-memory.dmp

Download

memory/3304-39-0x000001FD28BD0000-0x000001FD28BE0000-memory.dmp

Download

memory/3304-50-0x000001FD28C20000-0x000001FD28C30000-memory.dmp

Download

memory/3304-52-0x000001FD28C40000-0x000001FD28C50000-memory.dmp

Download

memory/3304-58-0x000001FD28C70000-0x000001FD28C80000-memory.dmp

Download

memory/3304-114-0x000001FD28CF0000-0x000001FD28D00000-memory.dmp

Download

memory/3304-124-0x000001FD27050000-0x000001FD27051000-memory.dmp

Download

memory/3304-59-0x000001FD28C60000-0x000001FD28C70000-memory.dmp

Download

memory/3304-129-0x000001FD28D00000-0x000001FD28D10000-memory.dmp

Download

memory/3304-62-0x000001FD28C80000-0x000001FD28C90000-memory.dmp

Download

memory/3304-208-0x000001FD28C60000-0x000001FD28C70000-memory.dmp

Download

memory/3304-134-0x000001FD28CB0000-0x000001FD28CC0000-memory.dmp

Download

memory/3304-138-0x000001FD28D10000-0x000001FD28D20000-memory.dmp

Download

memory/3304-143-0x000001FD28D20000-0x000001FD28D30000-memory.dmp

Download

memory/3304-212-0x000001FD28BE0000-0x000001FD28BF0000-memory.dmp

Download

memory/3304-151-0x000001FD28CD0000-0x000001FD28CE0000-memory.dmp

Download

memory/3304-153-0x000001FD28CE0000-0x000001FD28CF0000-memory.dmp

Download

memory/3304-154-0x000001FD28D50000-0x000001FD28D60000-memory.dmp

Download

memory/3304-213-0x000001FD28C00000-0x000001FD28C10000-memory.dmp

Download

memory/3304-214-0x000001FD28C10000-0x000001FD28C20000-memory.dmp

Download

memory/3304-157-0x000001FD28CF0000-0x000001FD28D00000-memory.dmp

Download

memory/3304-149-0x000001FD28CC0000-0x000001FD28CD0000-memory.dmp

Download

memory/3304-65-0x000001FD28BB0000-0x000001FD28BC0000-memory.dmp

Download

memory/3304-148-0x000001FD28D40000-0x000001FD28D50000-memory.dmp

Download

memory/3304-215-0x000001FD28C20000-0x000001FD28C30000-memory.dmp

Download

memory/3304-216-0x000001FD28C30000-0x000001FD28C40000-memory.dmp

Download

memory/3304-217-0x000001FD28C40000-0x000001FD28C50000-memory.dmp

Download

memory/3304-218-0x000001FD28C50000-0x000001FD28C60000-memory.dmp

Download

memory/3304-166-0x000001FD28D00000-0x000001FD28D10000-memory.dmp

Download

memory/3304-219-0x000001FD28C70000-0x000001FD28C80000-memory.dmp

Download

memory/3304-209-0x000001FD28BB0000-0x000001FD28BC0000-memory.dmp

Download

memory/3304-210-0x000001FD28BC0000-0x000001FD28BD0000-memory.dmp

Download

memory/3304-211-0x000001FD28BD0000-0x000001FD28BE0000-memory.dmp

Download

memory/3304-66-0x000001FD28C90000-0x000001FD28CA0000-memory.dmp

Download

memory/3304-67-0x000001FD28CA0000-0x000001FD28CB0000-memory.dmp

Download

memory/3304-207-0x000001FD27050000-0x000001FD27051000-memory.dmp

Download

memory/3304-181-0x000001FD27050000-0x000001FD27051000-memory.dmp

Download

memory/3304-73-0x000001FD28C00000-0x000001FD28C10000-memory.dmp

Download

memory/3304-68-0x000001FD28BC0000-0x000001FD28BD0000-memory.dmp

Download

memory/3304-57-0x000001FD28C50000-0x000001FD28C60000-memory.dmp

Download

memory/3304-194-0x000001FD28D20000-0x000001FD28D30000-memory.dmp

Download

memory/3304-196-0x000001FD28D30000-0x000001FD28D40000-memory.dmp

Download

memory/3304-197-0x000001FD28D40000-0x000001FD28D50000-memory.dmp

Download

memory/3304-56-0x000001FD28940000-0x000001FD28BB0000-memory.dmp

Download

memory/3304-51-0x000001FD28C30000-0x000001FD28C40000-memory.dmp

Download

memory/3352-245-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/3352-430-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/3352-422-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/3352-380-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/3352-374-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/3352-354-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/3352-312-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/3352-258-0x00000241C3530000-0x00000241C3531000-memory.dmp

Download

memory/4508-96-0x000001DC66590000-0x000001DC665A0000-memory.dmp

Download

memory/4508-171-0x000001DC66620000-0x000001DC66630000-memory.dmp

Download

memory/4508-161-0x000001DC665F0000-0x000001DC66600000-memory.dmp

Download

memory/4508-141-0x000001DC66580000-0x000001DC66590000-memory.dmp

Download

memory/4508-142-0x000001DC66590000-0x000001DC665A0000-memory.dmp

Download

memory/4508-158-0x000001DC665B0000-0x000001DC665C0000-memory.dmp

Download

memory/4508-159-0x000001DC665E0000-0x000001DC665F0000-memory.dmp

Download

memory/4508-150-0x000001DC665A0000-0x000001DC665B0000-memory.dmp

Download

memory/4508-135-0x000001DC66560000-0x000001DC66570000-memory.dmp

Download

memory/4508-136-0x000001DC665D0000-0x000001DC665E0000-memory.dmp

Download

memory/4508-128-0x000001DC66570000-0x000001DC66580000-memory.dmp

Download

memory/4508-116-0x000001DC66530000-0x000001DC66540000-memory.dmp

Download

memory/4508-118-0x000001DC66540000-0x000001DC66550000-memory.dmp

Download

memory/4508-167-0x000001DC66610000-0x000001DC66620000-memory.dmp

Download

memory/4508-119-0x000001DC66550000-0x000001DC66560000-memory.dmp

Download

memory/4508-120-0x000001DC665C0000-0x000001DC665D0000-memory.dmp

Download

memory/4508-115-0x000001DC665B0000-0x000001DC665C0000-memory.dmp

Download

memory/4508-164-0x000001DC665C0000-0x000001DC665D0000-memory.dmp

Download

memory/4508-104-0x000001DC665A0000-0x000001DC665B0000-memory.dmp

Download

memory/4508-95-0x000001DC66580000-0x000001DC66590000-memory.dmp

Download

memory/4508-448-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/4508-20-0x000001DC662C0000-0x000001DC66530000-memory.dmp

Download

memory/4508-305-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/4508-165-0x000001DC66600000-0x000001DC66610000-memory.dmp

Download

memory/4508-47-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/4508-78-0x000001DC66540000-0x000001DC66550000-memory.dmp

Download

memory/4508-170-0x000001DC665D0000-0x000001DC665E0000-memory.dmp

Download

memory/4508-88-0x000001DC66570000-0x000001DC66580000-memory.dmp

Download

memory/4508-74-0x000001DC66530000-0x000001DC66540000-memory.dmp

Download

memory/4508-87-0x000001DC66560000-0x000001DC66570000-memory.dmp

Download

memory/4508-61-0x000001DC662C0000-0x000001DC66530000-memory.dmp

Download

memory/4508-420-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/4508-180-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/4508-191-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/4508-79-0x000001DC66550000-0x000001DC66560000-memory.dmp

Download

memory/4508-419-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/4508-400-0x000001DC661C0000-0x000001DC661C1000-memory.dmp

Download

memory/5520-405-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-391-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-367-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-363-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-325-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-445-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-446-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-292-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-457-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-458-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

memory/5520-472-0x0000024947C30000-0x0000024947C31000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads