Edit tour

Windows Analysis Report
Form-8879_PDF.jar

Overview

General Information

Sample name:	Form-8879_PDF.jar
Analysis ID:	1513020
MD5:	aab581c5eec444fec05cf4d81bb57f66
SHA1:	d503d1d22720cb62571b9d36852eb07e764e052a
SHA256:	769fc3a07c8e31ebd1c6cc9dd91b3c4870688404aa255f6d615c4e60bcd6dec4
Tags:	193-142-146-64Jacksbotjarjrat
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Creates autostart registry keys to launch java

Exploit detected, runtime environment starts unknown processes

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Processes Spawned by Java.EXE

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7za.exe (PID: 6600 cmdline: 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\Form-8879_PDF.jar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 1700 cmdline: java.exe -jar "C:\Users\user\Desktop\Form-8879_PDF.jar" qt314.c1 MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 180 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 5820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4936 cmdline: wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3192 cmdline: wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

javaw.exe (PID: 6576 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

WMIC.exe (PID: 5820 cmdline: wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4416 cmdline: wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

javaw.exe (PID: 1984 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

WMIC.exe (PID: 2648 cmdline: wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 2724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6716 cmdline: wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\SysWOW64\wbem\WMIC.exe, SourceProcessId: 5820, StartAddress: 7574D700, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 5820

Sigma detected: Suspicious Processes Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Florian Roth: Data: Command: wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list, CommandLine: wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: java.exe -jar "C:\Users\user\Desktop\Form-8879_PDF.jar" qt314.c1, ParentImage: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ParentProcessId: 1700, ParentProcessName: java.exe, ProcessCommandLine: wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list, ProcessId: 4936, ProcessName: WMIC.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar", EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ProcessId: 1700, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javawrun

Suricata Signatures

ETPRO MALWARE Java/Jacksbot Checkin (INBOUND)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T11:21:36.368425+0200	2811489	1	Malware Command and Control Activity Detected	193.142.146.64	4439	192.168.2.4	49730	TCP
2024-09-18T11:21:48.539976+0200	2811489	1	Malware Command and Control Activity Detected	193.142.146.64	4439	192.168.2.4	49731	TCP
2024-09-18T11:21:56.728726+0200	2811489	1	Malware Command and Control Activity Detected	193.142.146.64	4439	192.168.2.4	49738	TCP

ETPRO MALWARE Java/Jacksbot Checkin (OUTBOUND)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T11:21:36.375447+0200	2811490	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.142.146.64	4439	TCP
2024-09-18T11:21:48.546620+0200	2811490	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:56.736001+0200	2811490	1	Malware Command and Control Activity Detected	192.168.2.4	49738	193.142.146.64	4439	TCP

ETPRO MALWARE Java/Jacksbot CnC Beacon

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T11:21:36.823509+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.142.146.64	4439	TCP
2024-09-18T11:21:36.850053+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.142.146.64	4439	TCP
2024-09-18T11:21:49.039314+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:49.046827+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:49.115317+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:49.122246+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:57.173907+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49738	193.142.146.64	4439	TCP
2024-09-18T11:21:57.178949+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49738	193.142.146.64	4439	TCP
2024-09-18T11:21:57.254712+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49738	193.142.146.64	4439	TCP
2024-09-18T11:21:57.289129+0200	2811491	1	Malware Command and Control Activity Detected	192.168.2.4	49738	193.142.146.64	4439	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\System32\conhost.exe

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 4x nop then cmp eax, dword ptr [ecx+04h]	2_2_0273F818
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 4x nop then cmp eax, dword ptr [ecx+04h]	10_2_02A6F818
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 4x nop then cmp eax, dword ptr [ecx+04h]	16_2_0299F5D8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2811489 - Severity 1 - ETPRO MALWARE Java/Jacksbot Checkin (INBOUND) : 193.142.146.64:4439 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2811489 - Severity 1 - ETPRO MALWARE Java/Jacksbot Checkin (INBOUND) : 193.142.146.64:4439 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2811489 - Severity 1 - ETPRO MALWARE Java/Jacksbot Checkin (INBOUND) : 193.142.146.64:4439 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2811490 - Severity 1 - ETPRO MALWARE Java/Jacksbot Checkin (OUTBOUND) : 192.168.2.4:49730 -> 193.142.146.64:4439
Source: Network traffic	Suricata IDS: 2811490 - Severity 1 - ETPRO MALWARE Java/Jacksbot Checkin (OUTBOUND) : 192.168.2.4:49731 -> 193.142.146.64:4439
Source: Network traffic	Suricata IDS: 2811490 - Severity 1 - ETPRO MALWARE Java/Jacksbot Checkin (OUTBOUND) : 192.168.2.4:49738 -> 193.142.146.64:4439
Source: Network traffic	Suricata IDS: 2811491 - Severity 1 - ETPRO MALWARE Java/Jacksbot CnC Beacon : 192.168.2.4:49731 -> 193.142.146.64:4439
Source: Network traffic	Suricata IDS: 2811491 - Severity 1 - ETPRO MALWARE Java/Jacksbot CnC Beacon : 192.168.2.4:49738 -> 193.142.146.64:4439
Source: Network traffic	Suricata IDS: 2811491 - Severity 1 - ETPRO MALWARE Java/Jacksbot CnC Beacon : 192.168.2.4:49730 -> 193.142.146.64:4439

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 193.142.146.64:4439

Source: Joe Sandbox View

ASN Name: HOSTSLICK-GERMANYNL HOSTSLICK-GERMANYNL

Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64

Source: java.exe, 00000002.00000002.2913838768.0000000004B59000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D92000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A193000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000002.00000002.2917193817.0000000009DFA000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A1FA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000002.00000002.2922090773.000000001525B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733468341.0000000015254000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2921864004.000000001564C000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1856884176.0000000015645000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1940221716.00000000155BB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1939834791.00000000155AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2922373987.00000000155C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000002.00000002.2917193817.0000000009DFA000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A1FA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000002.00000002.2917193817.0000000009D67000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000002.00000002.2917193817.0000000009DFA000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A1FA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009E03000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A203000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.000000000A003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000002.00000002.2922090773.000000001525B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733468341.0000000015254000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2921864004.000000001564C000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1856884176.0000000015645000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1940221716.00000000155BB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1939834791.00000000155AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2922373987.00000000155C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009E03000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A203000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.000000000A003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000002.00000002.2917193817.0000000009D67000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009E03000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A203000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.000000000A003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000002.00000002.2922090773.000000001525B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733468341.0000000015254000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2921864004.000000001564C000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1856884176.0000000015645000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1940221716.00000000155BB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1939834791.00000000155AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2922373987.00000000155C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000002.00000002.2913838768.0000000004B59000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000002.00000002.2920745169.0000000014F17000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009F13000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733229308.0000000014EB9000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733545806.0000000014F10000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2921864004.0000000015670000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A30D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1856884176.0000000015670000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.000000000A10E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2921114742.0000000015180000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1938796720.0000000015171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000002.00000002.2917193817.0000000009DFA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A1FA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000002.00000002.2922090773.000000001525B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733468341.0000000015254000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2921864004.000000001564C000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1856884176.0000000015645000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1940221716.00000000155BB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1939834791.00000000155AB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2922373987.00000000155C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000002.00000002.2917193817.0000000009D67000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: java.exe, 00000002.00000002.2913838768.0000000004B59000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2913838768.0000000004CC0000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2913899499.00000000050BE000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2913899499.0000000004FA9000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2913968262.0000000004EBF000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.000000000A591000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2913968262.0000000004B29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 2_2_02739DC9

2_2_02739DC9

Source: classification engine

Classification label: mal64.expl.winJAR@26/154@0/1

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:396:120:WilError_03

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\Form-8879_PDF.jar"
Source: C:\Windows\System32\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Desktop\Form-8879_PDF.jar" qt314.c1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list

Source: C:\Windows\System32\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: opengl32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: glu32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: napinsp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wshbth.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winrnr.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0273C244 push eax; ret	2_2_0273C245
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0273C248 push eax; ret	2_2_0273C249
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0273C24C push eax; ret	2_2_0273C24D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0273C238 push eax; ret	2_2_0273C241
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_02738EBB push es; retn 0001h	2_2_02738FBF
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0273E548 push es; retn 0024h	2_2_0273E54B
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0273C9DC pushad ; retf	2_2_0273C9DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269D8F7 push 00000000h; mov dword ptr [esp], esp	2_2_0269D921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269A20A push ecx; ret	2_2_0269A21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269A21B push ecx; ret	2_2_0269A225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269BB67 push 00000000h; mov dword ptr [esp], esp	2_2_0269BB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269B3B7 push 00000000h; mov dword ptr [esp], esp	2_2_0269B3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269D8E0 push 00000000h; mov dword ptr [esp], esp	2_2_0269D921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269B947 push 00000000h; mov dword ptr [esp], esp	2_2_0269B96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0269C477 push 00000000h; mov dword ptr [esp], esp	2_2_0269C49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CD8F7 push 00000000h; mov dword ptr [esp], esp	10_2_029CD921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CA21B push ecx; ret	10_2_029CA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CA20A push ecx; ret	10_2_029CA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CB3B7 push 00000000h; mov dword ptr [esp], esp	10_2_029CB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CBB67 push 00000000h; mov dword ptr [esp], esp	10_2_029CBB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CD8E0 push 00000000h; mov dword ptr [esp], esp	10_2_029CD921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CB947 push 00000000h; mov dword ptr [esp], esp	10_2_029CB96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_029CC477 push 00000000h; mov dword ptr [esp], esp	10_2_029CC49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A68EAD push es; retn 0001h	10_2_02A68FBF
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A6C244 push eax; ret	10_2_02A6C245
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A6C240 push eax; ret	10_2_02A6C241
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A6C24C push eax; ret	10_2_02A6C24D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A6C248 push eax; ret	10_2_02A6C249
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A6C9D4 pushad ; retf	10_2_02A6C9D5
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A6C9DC pushad ; retf	10_2_02A6C9DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 10_2_02A6E548 push es; retn 0024h	10_2_02A6E54B

Boot Survival

Creates autostart registry keys to launch java

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run javawrun "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar"

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run javawrun	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run javawrun	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run javawrun	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run javawrun	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run javawrun
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run javawrun

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation

Source: javaw.exe, 0000000A.00000002.2912133989.0000000001128000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlllM!
Source: javaw.exe, 00000010.00000002.2917141859.000000000A591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware-tray8
Source: javaw.exe, 00000010.00000002.2917141859.000000000A591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtoolsd8
Source: javaw.exe, 00000010.00000003.1886007560.0000000014ECC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000010.00000003.1886007560.0000000014ECC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.2912262156.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2912133989.0000000001128000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2911891794.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000010.00000002.2917141859.000000000A591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware8
Source: javaw.exe, 00000010.00000002.2917141859.000000000A591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: )C:\WINDOWS\System32\drivers\VBoxMouse.sys8
Source: javaw.exe, 00000010.00000003.1886007560.0000000014ECC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000002.2912262156.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2912133989.0000000001128000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2911891794.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: javaw.exe, 00000010.00000002.2917141859.000000000A591000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'C:\WINDOWS\System32\drivers\vmmouse.sys8
Source: javaw.exe, 00000010.00000003.1938332601.0000000015772000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: java.exe, 00000002.00000003.1673527917.0000000014C62000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1800708572.0000000015068000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1886007560.0000000014ECC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 00000002.00000002.2912262156.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2911891794.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 2_2_026903C0 cpuid

2_2_026903C0

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\1700 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\6576 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\1984 VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: java.exe, 00000002.00000002.2913838768.0000000004B30000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2913838768.0000000004B2E000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2913838768.0000000004B2C000.00000004.00000800.00020000.00000000.sdmp, WMIC.exe, 00000006.00000003.1721305345.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000002.1722259388.0000000002CDB000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000003.1721328486.0000000002CD2000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000003.1720897679.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000003.1721432377.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000002.1721801467.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2913899499.0000000004F76000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2913899499.0000000004F78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000006.00000002.1721712711.0000000000738000.00000004.00000010.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000002.1865564897.0000000000328000.00000004.00000010.00020000.00000000.sdmp, WMIC.exe, 00000013.00000002.1951558261.00000000008A8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ndows Defender\MsMpeng.exe
Source: WMIC.exe, 00000006.00000002.1721801467.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gnedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000006.00000003.1721485270.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000003.1721328486.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000002.1722208750.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000003.1865292229.0000000000666000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000003.1865123037.0000000000666000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000002.1865879215.0000000000666000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000013.00000002.1951887126.000000000095E000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000013.00000003.1951154763.0000000000959000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000013.00000003.1951322294.000000000095D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000006.00000002.1721801467.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000002.1865655295.00000000003F8000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000013.00000002.1952102554.0000000002C28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows Defender\MsMpeng.exe
Source: WMIC.exe, 00000006.00000003.1721328486.0000000002C9F000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000003.1720986614.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000003.1721062375.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000006.00000002.1722082602.0000000002CA1000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000003.1864694167.0000000002FA4000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000003.1865096793.0000000000680000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000003.1864745512.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000003.1865123037.000000000063F000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000C.00000002.1865735908.0000000000642000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000013.00000003.1951154763.000000000093F000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000013.00000002.1951952018.000000000097B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000006.00000002.1721801467.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000013.00000002.1952102554.0000000002C28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \MsMpeng.exe
Source: java.exe, 00000002.00000002.2913838768.0000000004B21000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2913899499.0000000004F73000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2913968262.0000000004AFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DpathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 0000000C.00000002.1865655295.00000000003F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\MsMpeng.exe

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	11 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Services File Permissions Weakness	11 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Services File Permissions Weakness	11 Process Injection	Security Account Manager	23 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Services File Permissions Weakness	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Form-8879_PDF.jar	0%	ReversingLabs

Source	Detection	Scanner	Label
http://java.oracle.com/	0%	Avira URL Cloud	safe
http://null.oracle.com/	0%	Avira URL Cloud	safe
http://bugreport.sun.com/bugreport/	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://java.oracle.com/	java.exe, 00000002.00000002.2913838768.0000000004B59000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://null.oracle.com/	java.exe, 00000002.00000002.2920745169.0000000014F17000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009F13000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733229308.0000000014EB9000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.1733545806.0000000014F10000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2921864004.0000000015670000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A30D000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000003.1856884176.0000000015670000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.000000000A10E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2921114742.0000000015180000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000010.00000003.1938796720.0000000015171000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreport.sun.com/bugreport/	java.exe, 00000002.00000002.2913838768.0000000004B59000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2917193817.0000000009D92000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000000A.00000002.2917143269.000000000A193000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000010.00000002.2917141859.0000000009F93000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.142.146.64	unknown	Netherlands		208046	HOSTSLICK-GERMANYNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513020
Start date and time:	2024-09-18 11:20:42 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Tracing
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Form-8879_PDF.jar
Detection:	MAL
Classification:	mal64.expl.winJAR@26/154@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 73% Number of executed functions: 41 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .jar

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target java.exe, PID 1700 because it is empty
Execution Graph export aborted for target javaw.exe, PID 1984 because it is empty
Execution Graph export aborted for target javaw.exe, PID 6576 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Form-8879_PDF.jar

Simulations

Behavior and APIs

Time	Type	Description
05:21:37	API Interceptor	6x Sleep call for process: WMIC.exe modified
10:21:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run javawrun "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar"
10:21:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run javawrun "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTSLICK-GERMANYNL	bot_library.exe	Get hash	malicious	Unknown	Browse	193.142.146.43
	SecuriteInfo.com.ELF.Mirai-CQT.17542.12898.elf	Get hash	malicious	Mirai	Browse	193.142.146.10
	arm7.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
	SecuriteInfo.com.ELF.Mirai-CQU.1502.23988.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
	arm7.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
	SecuriteInfo.com.ELF.Mirai-CQU.22530.21245.elf	Get hash	malicious	Mirai	Browse	193.142.146.10
	SecuriteInfo.com.ELF.Mirai-CQT.8033.1423.elf	Get hash	malicious	Mirai	Browse	193.142.146.10
	JuneOrder.exe	Get hash	malicious	AsyncRAT, Babadeda, PureLog Stealer, zgRAT	Browse	5.253.86.15
	TamenuV11.msi	Get hash	malicious	Unknown	Browse	5.253.86.15

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.818241583892493
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USJT0kvn:oJ5bJT0kvn
MD5:	4745996A747D532C8429B777F8048139
SHA1:	E89CF98FFD4F0B548CE0F3835526672E6F37CE80
SHA-256:	1C7367A00BE24D4F823E1F0987DFAFAF6EF09AEB164326A577FBCDF015A6978A
SHA-512:	29C31378358A41422C2A4D917762B7F0925AD09CC4DA8E759412E33B7092DFAA390978A1FA3589F7AEBCEF5F1B8B2BF7915F9F99662FABAE321E70E140A11739
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre-1.8..1726651314566..

C:\Users\user\AppData\Local\Temp\hsperfdata_user\1700

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.287040436356198
Encrypted:	false
SSDEEP:	96:ERIrvls8GEIK2Hjy960YwaQgvADVF7TWHG1bowH:ER4G8GLK2Hjq6ogv4VJKHGd
MD5:	4DD613D9D4CA53F0DEF746D2EC869F9E
SHA1:	BD934E5B17BD8EABFDA7754CD46198B3A36D19B1
SHA-256:	55504F72E88254CFB82F96B94409104B7BC86336903E8BDA1D5351A2D0F12B81
SHA-512:	7E26737C1936FF1B564FB10C5F0DE1B061046D549A3A28C92DC63AB5B8811974691695A68744E6F42497F202FF554918AAD47E125EBCD9246C8ED4C9E02CAE9A
Malicious:	false
Preview:	........@9......r.+..... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\1984

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2813876192610518
Encrypted:	false
SSDEEP:	96:oR6rWI8Gi7kfHvG6te5OnkIbnFVoSTiHG1bow3:oRY8Gi7kfHvG6GI5VLeHGd
MD5:	45FDB2FBB0696EC5A7803AC73BF947BF
SHA1:	10D665B98909273A14D47CBFB60B82A42159A31C
SHA-256:	E8E3FB88A41F446EB140CB2081B9311C00B97663F322CE2519E264B1ABC2BE7E
SHA-512:	614687B76084079E7E0CF5A7E8DD5ACBFDA99DDD2279D171E20D9B4AB8E044CCBB224175903BD3827C46E7D83DDD4410DDC946383D86429D32184BD92B0AC3A4
Malicious:	false
Preview:	........ 9............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6576

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.282199542778978
Encrypted:	false
SSDEEP:	96:6RQr028Gn2AUHPl6BfwlwG3EgamVoSTiHG1bow3sm:6RW8Gn2AUHPl6+mgXVLeHGd/
MD5:	07A9F1EEC1041EA2A99AA5606E4C6E4C
SHA1:	D9452FF41CDF8E8365873C3EE966B2031CF5C0B5
SHA-256:	EE88540FEDC3036AC9938803F73F4C02A57621A274B1F2A44DFDC4743716BCF9
SHA-512:	BA8D6D3A01D08CF2BEA7469ACDAF951FA90B28E67EDF2CBD0FE348A83085110AB7AD786BE015D15E23D593D2250DF2A09999DF862AEC6BCB6F60B9B76FF68D8D
Malicious:	false
Preview:	........ 9.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
SSDEEP:	3:/lwlt7n:WNn
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Preview:	........................................J2SE.

C:\jar\META-INF\MANIFEST.MF

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.516155737869594
Encrypted:	false
SSDEEP:	3:ZLCAWIzBEB1LbIThv:1KItcbA5
MD5:	DD5C908EE88B8CAAD55EE86233EBF3E3
SHA1:	37E0F4EE8BE42027578D7C9FE638A9AA70C567E8
SHA-256:	1559EE2825ACB63358979E87FD78559561F82779F30E9513D7F8432EE08E29D9
SHA-512:	56D83939B24784C75D8ECDBA20D0CD2D379B9898FA3C9FFAECC3951AD61861C066502255C0949317F1956679863DBD86824A848CED6B783BCBFAA65E61083FD0
Malicious:	false
Preview:	Manifest-Version: 1.0..Class-Path: ...Main-Class: qt314.c1....

C:\jar\config.dat

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	7.329398303381
Encrypted:	false
SSDEEP:	12:BiV9+uKlX1CG80QHqyVnWkNUD7ccqqpsILfiJ:luMV8RqyVnWkSD7DpsILs
MD5:	C7BA93D9DFCC4E1D830C3BF4EC36B345
SHA1:	6974F125912A5E4002E33AD9DAEF06D0D9286904
SHA-256:	C2CB73B076746E592603D1B4146AC560684FFDA940DEF995A97DCBA38F04E018
SHA-512:	19BFFBE4AB3DDB214ECB2D62124318B4206FBFA855EC6668BC460A5AACA823BD10D695472AAF2D9A3EC564B98A4C901444455146796AD46CA8708B59DCDE667F
Malicious:	false
Preview:	.....w.5tHupL.......T.q..P.O>.#`n..l.U6.S...<Oh.wR..r..[.D?8.........6....s.#.M...2z..F...q..f......yS.."...n..:.c.Cu..HO?Pm.c...0...n..........t........X.B..mo...=QA......w...Z..a.Pm.c...0...n...S..(.1Q....'V......SG..!N.h...<Pm.c...0...n...J..c ..]...2..........w.^B...#.H.Z.3.P.6....-.....N.....A.p.Pm.c...0...n.......y....N-..N[`...X.B..mo...=QAC.Fz'z........L..\JY9.........cII....Y1d#....M.!......Kf.9X.

C:\jar\key.dat

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:PZPYn:5Y
MD5:	1D451196CCCBB9DC14BCE24F9D08CFDB
SHA1:	8B63E0FFF5E0FBE4AA82443DD714857393C60054
SHA-256:	06021C747E651907CA9A88836F88D20D5F35EA06C23C70356F34E8454274EA8D
SHA-512:	00AC0911B129E14F7DBA5378BF9FE0F01B69310FD1BA5098273626006EFA4A68D4981075FA7ABFB1785BE505CD016D734D3A2A38E1AE7F2E92103ACF80BD4FEA
Malicious:	false
Preview:	..K~i..A...>bp.=

C:\jar\qt314\A.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2084
Entropy (8bit):	5.577470874850901
Encrypted:	false
SSDEEP:	48:/MRnD5g/ZA/bECe4SH9twZB9dPvTIlYWjb6J0:kRnEWTECe59t+DylY3y
MD5:	871142226E4770BD6353344092E7CDE0
SHA1:	59147F45918CB1F9CB76F8C6C4443C36A1847BEB
SHA-256:	ACB948B0082B42E339292C1C30E39FFEEE831F35412A08186F29B69B88E518B7
SHA-512:	8014E495127F91204D5B9261332C4552F71F0CD4CCD4483974C4F665A8E19274BE04552BBFD942B0B0F9D7C082E2076ABBDFFA2A9C75D5E20E9F6851F02E1436
Malicious:	false
Preview:	.......2.....qt314/a......java/lang/Object......a.java...lllIlIllII...[Ljava/lang/String;...a...I...<clinit>...()V...lIIllIIIIIll.......................<init>.............()Lqt314/cY;...qt314/cq......l.............lIIllIIlIIIl...(II)Z.......................java/lang/String.. ...split..'(Ljava/lang/String;)[Ljava/lang/String;..".#..!.$...qt314/cY..&...java/lang/Integer..(...parseInt...(Ljava/lang/String;)I..*.+..).,...(Ljava/lang/String;I)V.......'./...lIIllIIIIIlI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception..3...javax/crypto/spec/SecretKeySpec..5...MD5..7...java/security/MessageDigest..9...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..;.<..:.=..!java/nio/charset/StandardCharsets..?...UTF_8...Ljava/nio/charset/Charset;..A.B..@.C...getBytes...(Ljava/nio/charset/Charset;)[B..E.F..!.G...digest...([B)[B..I.J..:.K...java/util/Arrays..M...copyOf...([BI)[B..O.P..N.Q...DES..S...([BLjava/lang/String;)V....U..6.V...javax/crypto/Cipher..X..)(

C:\jar\qt314\B.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1633
Entropy (8bit):	5.472845231160543
Encrypted:	false
SSDEEP:	48:eZ7tzhI8hXE9NWSY1WLYJTNA4ypQ51BUwe3tlI:OQ8pEWb1FJTND5UrI
MD5:	F7E16C4B2CE062DD5F3F8A2315A8945C
SHA1:	69C13057F424875D9E041CC7E56A352882AC18B2
SHA-256:	4019DFBD8A197F7D9421FAC11ACED81B362B3FB07EF94533337389BC06CCCF7A
SHA-512:	C9A48174934351A6AB4467A6AB5CC801A3D94F54937986C63151549E6865675B75036AD532F4B6A367BD3D76777906143B1F82915FC556212F6B5AFFA47AAC75
Malicious:	false
Preview:	.......2.u...qt314/b......java/lang/Object......java/lang/Runnable......b.java...b...[B...g...Ljava/net/DatagramPacket;...a...Ljava/lang/String;...e...Ljava/util/Random;...d...I...f...Ljava/net/DatagramSocket;...c...<clinit>...()V...lIIIIlllIlII...(I)Z...<init>...(Ljava/lang/String;I)V...qt314/cC......Z................... ...java/util/Random.."..#. .........%.........'.........)...qt314/al..+..,.................0...java/lang/String..2...length...()I..4.5..3.6... ..8...lIIIIlllIlIl...lIIIIlllIllI...run...java/lang/Exception..=...nextInt..?.5..#.@.........B..:......D...java/net/DatagramSocket..F..G. .........I...java/net/InetAddress..K...getByName..*(Ljava/lang/String;)Ljava/net/InetAddress;..M.N..L.O...connect...(Ljava/net/InetAddress;I)V..Q.R..G.S.........U...nextBytes...([B)V..W.X..#.Y...java/net/DatagramPacket..[...([BI)V....]..\.^.........`...send...(Ljava/net/DatagramPacket;)V..b.c..G.d...close..f....G.g...printStackTrace..i....>.j...qt314/f..l.......m.n..;......p...Code...StackMap

C:\jar\qt314\C.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1278
Entropy (8bit):	5.408890077809205
Encrypted:	false
SSDEEP:	24:ZrvQG678517LmPxTOS2C8TDc2Ulux+yOLubjP6tvWmkGZm:ZjQGR5BmpTD2C8P8lG+yynx9kG4
MD5:	92901C17586A2A1A4E3ECF4B90A375CD
SHA1:	7403D26B552A0E2EC0942D2F89F42D34E5BEB5A1
SHA-256:	EFD6A0BDD08597B83CA5B7407C16363D9E1D6A8FECDE477BF5E8687C5F2394B3
SHA-512:	5AB08664519056B7FE2FB3DD9FAB363D2A78CAE54961C694260FB1A8A7A453BFB7AD349A57445A3A8BC98FC1BB11C0F6C043768EDCF087DFE630873CF6A7478A
Malicious:	false
Preview:	.......2.Q...qt314/c......java/lang/Object......c.java...a...Z...<clinit>...()V...([B)[B...java/lang/Exception......java/io/ByteArrayInputStream......<init>...([B)V.............(Ljava/io/InputStream;)[B.............b.............java/io/ByteArrayOutputStream................java/util/zip/GZIPOutputStream......(Ljava/io/OutputStream;)V......... ...qt314/a9.."...(Ljava/io/InputStream;Ljava/io/OutputStream;)J....$..#.%...close..'......(...toByteArray...()[B...+....,...qt314/al........../.0...lIIlllIIlIll...(I)Z..2.3....4.....6...java/lang/String..8...length...()I..:.;..9.<... ..>...java/io/InputStream..@...[B..B..............E...java/util/zip/GZIPInputStream..G...(Ljava/io/InputStream;)V....I..H.J..H.(...Code...Exceptions...StackMapTable...SourceFile.!...........................M..........................M...............Y............N.................M...........g...>...Y...L...Y+..!M*,..&X,..)+..-..1..5..=...5..2.7..=W.?..=t........7..=W...]..U.....?..=..............,.a.a.....3.D.....

C:\jar\qt314\D.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	853
Entropy (8bit):	5.411624098719955
Encrypted:	false
SSDEEP:	24:sZmccgP6P0FknAIjyYRyeslXwzuBfsNeKr1+:sZmccK7kAWyYjYYkSB1+
MD5:	DCEDBADF852BED82428FE2390E252E21
SHA1:	EAB72A9574BAD9FE7FB31B9E051F837B2B7399CB
SHA-256:	B582D36107C9DB702DED55977C0FF3E53915B2506244E4861D9C17D13714459E
SHA-512:	7BC0EB699E524757257D2C604669F3D078273178F444DEA171108732759F18FA48A1B70866A2E53079E78F0787DC280ABBFFD2D1FA8A6EB1D2F011D8129A24E9
Malicious:	false
Preview:	.......2.9...qt314/d......java/lang/Object......java/lang/Runnable......d.java...a...Lqt314/cf;...b...Ljava/lang/Class;...c...Ljava/lang/reflect/Method;...<clinit>...()V...run...java/lang/Exception..........................java/lang/Class......newInstance...()Ljava/lang/Object;.............java/lang/String......java/lang/reflect/Method......invoke..9(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;..!.".. .#.....%...length...()I..'.(....)... ..+...printStackTrace..-..........<init>..8(Lqt314/cf;Ljava/lang/reflect/Method;Ljava/lang/Class;)V.........2..0......4...Code...StackMapTable...SourceFile. .............................................6..........................6...m.......J.............Y.....S..$.&..X.&..W.Z.c`.!d..`.1..`.d.d`..,......L+../........D.....7........D.......0.1...6... ........+..3,...-...*..5........8......

C:\jar\qt314\M.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	7077
Entropy (8bit):	5.890634595972081
Encrypted:	false
SSDEEP:	192:vT/6giRMYa0RGXbIUMlNlr/Hqsx93omYy95byVvskf:bqRMYx+IUMbKmcskf
MD5:	BB7E69C88CD38F248409A7F9D16AEC56
SHA1:	85D2588A2589ECE2CDB89F3193597361FB46CEFC
SHA-256:	BA7C4A5358FD3CA805FA25B16EC7E32AE5523E4D564EA41A44B74E0C04F15F26
SHA-512:	EDF28341CAFC0C07C1D8EFE5B08B500D871AF38746C542ED4B12A156F9DB84287E448A3CA99FC5C896D27FD7CD4B5F1B70C1E98B848450EBF64CD96016DA18CD
Malicious:	false
Preview:	.......2.^...qt314/m......java/lang/Object......java/lang/Runnable......m.java...f...I...g...d...lllIIIIIlI...[Ljava/lang/String;...c...Lqt314/m;...b...[Ljava/awt/image/BufferedImage;...z...Ljava/lang/String;...a...e..!(Ljava/awt/image/BufferedImage;)I...java/awt/image/BufferedImage......getRaster..!()Ljava/awt/image/WritableRaster;.............getWidth...()I.............getHeight..!......"...java/awt/image/WritableRaster..$...getPixels...(IIII[I)[I..&.'..%.(.....*...java/lang/String..,...length.......-./... ..1... ..3... ..5...lIIIllllIIll...(II)Z..7.8....9...[I..;...()V...java/lang/Exception..>...qt314/S..@...<init>..B.=..A.C...qt314/cd..E...(Lqt314/u;)V....G..F.H...printStackTrace..J.=..?.K...lIIIllllIlIl...lIIIllllIIlI..?(Ljava/awt/image/BufferedImage;Ljava/awt/image/BufferedImage;)Z...lIIIlllllIlI...(Ljava/lang/Object;)Z..P.Q....R...getRGB...(II)I..T.U....V...lIIIlllllIIl..X.8....Y...lIIIllllIlII...(DD)I...(I)V.........^...lIIIlllllIll.........a...lIIIllllIllI...(I)Z...lIIIlllI

C:\jar\qt314\N.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4475
Entropy (8bit):	5.758494710819597
Encrypted:	false
SSDEEP:	96:R4VEveLuXLeS3T56CqlWYhF2j7JwqPLL2SB8B:RreS13qlWHJw8w
MD5:	0501056976A6907BE732703C92E7137C
SHA1:	B6082B4AA1AB352ECB1F86E10D547A9628CFF878
SHA-256:	1C344164A15E196F9F0A991989E95C64780A3330EA781BDDEE307A2AF8D898D9
SHA-512:	8EB1BD47C4C2C2665CC350F83057EB443515E275BA54A67665869C2BEC7C530B835334C45B60AE808C35CDA919195DDC74C779E12E784E8217B83E680D348B9E
Malicious:	false
Preview:	.......2.....qt314/n......java/lang/Object......n.java...b...Z...llIllIllII...[Ljava/lang/String;...a...Ljava/util/Map;...<init>...()V.............lIIIlIllIIll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.. .!...."...java/lang/String..$...getBytes...(Ljava/nio/charset/Charset;)[B..&.'..%.(...digest...([B)[B..*.+....,...java/util/Arrays......copyOf...([BI)[B..0.1../.2...DES..4...([BLjava/lang/String;)V....6....7...javax/crypto/Cipher..9..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....;..:.<...init...(ILjava/security/Key;)V..>.?..:.@...java/util/Base64..B...getDecoder...()Ljava/util/Base64$Decoder;..D.E..C.F...java/util/Base64$Decoder..H...decode..J.+..I.K...doFinal..M.+..:.N...([BLjava/nio/charset/Charset;)V....P..%.Q...pr

C:\jar\qt314\O.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	5.526887979365379
Encrypted:	false
SSDEEP:	48:9oblurFw0lTZQEPeLVjSBV32jlYlTJ7ZTlrYK0:9oErF2EPeLVEV8lYBFjYK0
MD5:	7B165AB73F7B41FEFDFDB698727368A2
SHA1:	6DC476B16EC6903B4D514FF01B37F495D9AD1676
SHA-256:	798020446719614AD800BD0D36814E36D6206D47F90DD1307A7844AD477EF860
SHA-512:	C301E993C96683955BA9E18DBA4E79317609CF111C02AE88C678C29FCA24453EA3F3FCBED319A21F9EFC2735F4BC45F4AF43C7803D7D931500428C9718798DD3
Malicious:	false
Preview:	.......2.....qt314/o......qt314/n......o.java...lllIIlIlIl...[Ljava/lang/String;...c...Ljava/lang/String;...lIIlIIllIIlI...()V...java/lang/String................Hzkm5yILeD4=......TpPwq......lIIlIIllIIII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............<clinit>.............<init>...(Ljava/lang/String;)V.......................a...(Ljava/io/File;)V...java/lang/Exception..#...java/awt/Desktop..%...getDesktop...()Ljava/awt/Desktop;..'.(..&.)...open..+."..&.,...javax/crypto/spec/SecretKeySpec......MD5..0...java/security/MessageDigest..2...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..4.5..3.6..!java/nio/charset/StandardCharsets..8...UTF_8...Ljava/nio/charset/Charset;..:.;..9.<...getBytes...(Ljava/nio/charset/Charset;)[B..>.?....@...digest...([B)[B..B.C..3.D...Blowfish..F...([BLjava/lang/String;)V....H../.I...javax/crypto/Cipher..K..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..4.M..L.N...init...(ILjava/security/Key;)V..P.Q..L.R...java/util/Base64..T...g

C:\jar\qt314\P.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2724
Entropy (8bit):	5.7337434628985875
Encrypted:	false
SSDEEP:	48:59p8CkS/pTEuedHFKVyfK/4/l3McYW0Wzd25wfy/De+:54lCNEue5FKyl8Mzswye+
MD5:	8B2F9433543A8740F77B3F0E21BE338D
SHA1:	3B8885D2AA4FC6403AF7767FD5DD5E5231C0FA4C
SHA-256:	8C6560AE94677F22A05A15D8BD6614E51742DEB5EDA6621B7AE4E8158FBBB1A5
SHA-512:	EC70B922BD180AB821FD0C455596200CE0FF8163B955B3D78E7A9A57B387B3E049CB0BA8F6073222445570AD216D390CD676559EA2C8593164CC12CD7481B4EE
Malicious:	false
Preview:	.......2.....qt314/p......qt314/n......p.java...llllIIIlll...[Ljava/lang/String;...z...Ljava/lang/String;...lIIllllIlIlI...()V...java/lang/String................rYQ7hehvMrk=......UvkZK......lIIllllIlIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............<clinit>...................length...()I............. ..!.........#...toCharArray...()[C..%.&....'... ..)... ..+...lIIllllIlIll...(II)Z..-....../...<init>...([C)V..1.2....3...intern...()Ljava/lang/String;..5.6....7...[C..9...java/lang/Exception..;...javax/crypto/spec/SecretKeySpec..=...MD5..?...java/security/MessageDigest..A...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..C.D..B.E..!java/nio/charset/StandardCharsets..G...UTF_8...Ljava/nio/charset/Charset;..I.J..H.K...getBytes...(Ljava/nio/charset/Charset;)[B..M.N....O...digest...([B)[B..Q.R..B.S...java/util/Arrays..U...copyOf...([BI)[B..W.X..V.Y...DES..[...([BLjava/lang/String;)V..1.]..>.^...javax/crypto/Cipher..`..)(Ljava/lang/String;)Ljavax/cry

C:\jar\qt314\Q.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4597
Entropy (8bit):	5.885209716640374
Encrypted:	false
SSDEEP:	96:HgJpIvpKhmuEtkt+bvKqnlNwN+CIdpnFYLf5em08lQ:HgJyvpKAWozlNwN+NFufn00Q
MD5:	780CAAE060B7683BBE541A6278C98D7C
SHA1:	A1310F8B4961B0C8386BFE7EAD423E70669A5913
SHA-256:	B40FA2F870CEEB0F549CCEBACC56D22A8EB6F4C9E57275EF6B926D1D29A12230
SHA-512:	48EAD1B12CDECA3B93F8EA32ED3BE424E3917334DDEB9CD7A1782B75FB74FE55B97880AF939BE446BC66D58E845D8785184EDA2344F00FE4DCDAF2EF787445DA
Malicious:	false
Preview:	.......2.....qt314/q......qt314/n......q.java...lllIllIlII...[Ljava/lang/String;...z...<clinit>...()V...lIIllIIllllI.............java/lang/String......................length...()I............. ...... ...... ................toCharArray...()[C.. .!...."...lIIllIlIllII...(II)Z..$.%....&...<init>...([C)V..(.)....*...intern...()Ljava/lang/String;..,.-...........[C..1...Nut41TZHHu583kuNTF/Eew==..3...ImjBY..5...lIIllIIlllII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;..7.8....9...FTx/FA==..;...vMrLE..=...lIIllIIlllIl..?.8....@...UhJpLA==..B...vhsgK..D...3zy/eDDUwxVVkNFv2UsFLw==..F...SHjgn..H...ME/KDi1b8Ro=..J...qjxkr..L...KT18DQ==..N...ILqUz..P...lIIllIlIlllI..(......S...a...(Ljava/io/File;)V...java/lang/Exception..W...b...Z..Y.Z....[...qt314/ah..]...getOperatingSystem...()Lqt314/ah;.._.`..^.a...WINDOWS...Lqt314/ah;..c.d..^.e...lIIllIlIlIII..'(Ljava/lang/Object;Ljava/lang/Object;)Z..g.h....i...java/lang/Runtime..k...getRuntime...()Ljava/lang/Runtime;..m.n..l.o...java/lang/Str

C:\jar\qt314\S.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	341
Entropy (8bit):	4.730543314780936
Encrypted:	false
SSDEEP:	6:H8SRPtWZ6sqzsW4i2eoXMk6FDsDwJw0CByN0lXv3olFloz1qlOv/AIGt4n:hRUeYt1MBtsstD01vovloz1dvoI64n
MD5:	3631570DC2EF78AC8724D17C399C6BF6
SHA1:	901B0169124F00D5C0D1D940DEEC2D13C90276BC
SHA-256:	E5D851DB58F7A7E38D84D2326105AFCC66D120F5978A37C387A2C1D37E934F42
SHA-512:	D2967795FE4C46FD49FB5F5DC017DBD48CB23CACC47DB5C4AC3DB7ECF3FDB4659181C675D217C0EA78EC969EAB127E451B9E715893B82C956F63ACD934E9A49B
Malicious:	false
Preview:	.......2.....qt314/s......java/lang/Object......qt314/cS......s.java...<clinit>...()V...<init>.............a...(Ljava/lang/String;)V...java/lang/Exception......qt314/cd......b.............Code...Exceptions...SourceFile. .............................................................*..............................+............................

C:\jar\qt314\T.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	825
Entropy (8bit):	5.025533097803822
Encrypted:	false
SSDEEP:	12:6lAK2JkvYzEKMqKOMWWx+SQ7MccnxIM2zkd4gT+Oa1N3Gvlo9V4lYYyTA+ion:6lcoaXW49Cx0zux+p1G98RYSA0n
MD5:	C5DC67C62E149CCD38A30F31DBBC5907
SHA1:	35FA04529C89E6B5044FCBED2E6B6256958A1050
SHA-256:	4BEAD32E31C3EF0939AB43EBEB2C1F2455BF52A3538376DCE66C380A6D33099C
SHA-512:	71C7C0C8EDCAD70567ABCB4252759D115FFC71A1DE64019A75A4FE84CFC47F9F3320C8155CDD6A32067853602D5FFF109D87D12DF1AE0A0E1030BABCC0EFE99E
Malicious:	false
Preview:	.......2.4...qt314/t......java/lang/Exception......t.java...a...I...<clinit>...()V...<init>..(Ljava/lang/String;Ljava/lang/Throwable;)V.............(Ljava/lang/Throwable;)V.......................llllIIllIll...(I)Z..,(Ljava/lang/String;Ljava/lang/Throwable;ZZ)V.................................qt314/al......b...Z......... ....."...java/lang/String..$...length...()I..&.'..%.(... .....java/lang/Throwable..,...(Ljava/lang/String;)V........./...Code...StackMapTable...SourceFile.!...........................1..........................1............+,.................1............+.................1.............................1...!.......................2.......@..........1...e.......;...6.+,.............'..!........#..)W.+..)t............!......2........6.......%..-.....@...........1............+..0........3......

C:\jar\qt314\Y.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.907612668181375
Encrypted:	false
SSDEEP:	12:ClAL/MOlv1tQM0d4Sv1t4gl4yyWO72/d1on:Cl0p3uC21OfS/Xon
MD5:	CE3F5AC53EDD529FE4F14F5037772328
SHA1:	188B98D39C0D67862AFA06B47DF0A3FFFE993459
SHA-256:	F74716DF2C6CF49B137CA9492CA392AB06405C66CC67784A78A6F5BD41151220
SHA-512:	87AE2D7DE87FC7B69FF12654910E64B8A23E34F1771F87A2A55C0DB23047FA760C047F0647302DFBFCB777BEA490D3427250D1CBDE0BCFC32ACD327874FFE242
Malicious:	false
Preview:	.......2.....qt314/y......qt314/u......y.java...b...Ljava/lang/String;...a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............<init>...()V.............<clinit>...Code...Exceptions...SourceFile.!.....................................................................,................................................*+.............................................

C:\jar\qt314\Z.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.905908633187779
Encrypted:	false
SSDEEP:	12:ClAYm/MOlv1tQM0KYet4gl4RyWStma1h2O/Qn:ClZmp3uvevbthh7/Qn
MD5:	75CD4E78D753DAA039BDD1B8E10A2727
SHA1:	39B41FF16E919367AB87EA301DD0F04273D322D9
SHA-256:	679588952D2B302E40B7BC6FE9753692B1BE6EB2CF1C984E5C9D7D9F1AB4176E
SHA-512:	0D25FD08182BF1B6B5A90B53A4FAC76C1EBD72883DEA6A726672FA6C1EB19F4BAA0422F0690B97BE98975F16F40BBB67AE9C2BC8538FFE798C90E550783F7E9D
Malicious:	false
Preview:	.......2.....qt314/z......qt314/u......z.java...b...Ljava/lang/String;...a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............<clinit>...()V...<init>.............Code...Exceptions...SourceFile.!.....................................................................,...........................................................................*+..................

C:\jar\qt314\a0.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1006
Entropy (8bit):	5.376923484033165
Encrypted:	false
SSDEEP:	12:h6vtyM3i0qlzau1PzMQlyxlEMdP2OqPyA5UQ7M0cnRFukd1zka4dfXuhSUVIp3V2:h61yzMuyuO66RFp1zKEQ3509O0FSM3
MD5:	36AA020CCDCB09D7740C8D3A0C8953D1
SHA1:	BB7A95EEB29AD9AD3ED635A7E209340CFA770104
SHA-256:	238FFE4A7855D6CD19E2E7EB13E7AB4D8E45CB83986D71FB524BF20B62BEBDBE
SHA-512:	7EA3DA761868962DAE83EB3295FF0AD59D8C40A6302984831402A311BDE195689544E9F36925E3A45018FD31021C6D8571C9B92B23AD8FF8A3B86C1A9E17072B
Malicious:	false
Preview:	.......2.M...qt314/a0......qt314/al......a0.java...a...()V...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............qt314/r......Lqt314/r;.............lIIIlIlIIlll...(Ljava/lang/Object;)Z.............java/io/PrintWriter......c...Ljava/lang/Process;.............java/lang/Process......getOutputStream...()Ljava/io/OutputStream;..!.".. .#...<init>...(Ljava/io/OutputStream;Z)V..%.&....'...println...(Ljava/lang/String;)V..).....+...qt314/aF..-...Z..../....0...lIIIlIlIlIII...(I)Z..2.3....4...qt314/aJ..6.......7.8.....:...java/lang/String..<...length...()I..>.?..=.@... ..B... ..D..%......F...<clinit>...Code...StackMapTable...Exceptions...SourceFile.!...................I...........`...L........#...Y........$...(M,+..,..1..5..5..9.....,.;..AW.C..A.E..A........Y..9..$...(M,+..,......6.J.....J........-..=\......K...........2.3...I...!.......................J.......@....%.....I..............G..............I...!........*..............J.......@....H.....I....................L

C:\jar\qt314\a1.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	732
Entropy (8bit):	5.105057628374558
Encrypted:	false
SSDEEP:	12:bA//MOc5Fl+kMaMnRSv1tAROMnOlNyl8U37MxnslY1zka4Fl/elXyjPaCqtrayAR:M/YEy3GKQlDQEY1zKlGFygtrakuX
MD5:	A6D7335E8D527EE90BE439E34CD34D33
SHA1:	2035A6A2E4F949E91F518EE75DFE167A5C2E6B12
SHA-256:	DF74C22C41627FCEF72F988F5A989E692A1A8CF90C8114C7ED2E3942CB6A41DC
SHA-512:	B80B3D9D63A6E2DC10F5DC830A1CB7A3A08F688F67C8F3623B86A67624414D0C65216522AD20E2FE7D74B68DB53E585BA7A724D6388F1E41EC78B618D6928EE8
Malicious:	false
Preview:	.......2.-...qt314/a1......qt314/u......a1.java...b...Ljava/lang/String;...c...lIIlIIlIlIlI...(Ljava/lang/Object;)Z...a...()B...<init>..'(Ljava/lang/String;Ljava/lang/String;)V...()V................................'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/cS......(Ljava/lang/String;)V......................... ...java/lang/String.."...length...()I..$.%..#.&...<clinit>...Code...StackMapTable...Exceptions...SourceFile.!...................................)...!.............................@..........).............1..............)...............+...,.................)...L.......+,.................,.........!..'W..............).....*......i.....+...........(.....)....................,......

C:\jar\qt314\a2.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.437355990129266
Encrypted:	false
SSDEEP:	6:aEqBFSRPev6sz40stqMgnsbQ4Tjlssacloz14l9yx1EXfg:ap+R2v6SDsbQ4XlNHloz1o9a1Evg
MD5:	2CD175BA612984848E1495C4B6D5420D
SHA1:	31CA92A8A3EA60EC7BD8B5018171AF0986C1E793
SHA-256:	79BD57F6C633B286F598B9AC2884A79A3CC6FCF4C8F5F986A51535B775DCA156
SHA-512:	0BF48C2D1A1DD372092171827D081D6E07293A4E21610B31B0CB12E28EC3F5F95D3488560F84C468F81FEBB3F51DF9B5A887CDB00C9A1A7E60A72006690200B9
Malicious:	false
Preview:	.......2.....qt314/a2......java/lang/Object......a2.java...a...I...b...<init>...()V.............<clinit>.......................Code...SourceFile.!................................................*.....................................................

C:\jar\qt314\a3.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	445
Entropy (8bit):	4.893643578586121
Encrypted:	false
SSDEEP:	12:Clmkm/MOOv1tpM3/Sv1t4glRy2ClWX1on:Cl0a3G21Scon
MD5:	CC8C28CD0A237C31D9B7BA8A975EDA3B
SHA1:	BF9226B6DD90966A28FF94BEE643305F52A79F83
SHA-256:	EBE8D8E96CAE708A9421CEB63540C9B6976A6A05098E9271AC560A82265E16CD
SHA-512:	EC35854336348EE0C88F577DF65A89B0E8310708341D2789707133822FFE4DCBCF7C4431C525DAA3842038711AB5C5C7B621B61866C4BD882D7A8D28E0FA330B
Malicious:	false
Preview:	.......2.....qt314/a3......qt314/u......a3.java...b...Ljava/lang/String;...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............()B...<init>...()V.............<clinit>...Code...Exceptions...SourceFile.!........................................,..............................................A..............................*+.............................................

C:\jar\qt314\a4.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.071422998910314
Encrypted:	false
SSDEEP:	12:+lmJks/6lz1ii0cTX7MWJnzVX1ZkJzka4tp4W4kGlBRV+loZcHp4XDP3n:amuzz0cTXjZxX1ZkJzC4Wd0RVaFJqz3n
MD5:	C06E36A2577D73AF42C8A9E22FE193D3
SHA1:	284C1EA69B72613DE7F69A32E0E4BE8364F652E1
SHA-256:	318363BEFED9F2F217D63B3C7876EE13D21DE055F9D31FCA557411AF280DB496
SHA-512:	FEAF659F430E85DAD2CDB969E0FF87902F7DAB4E19F573BCADDF2C6961FFDA78AC970D2863BC179B96C8E9FC25DE7AB53BE0FF5BFE2F696F5B26E893BA91A4D5
Malicious:	false
Preview:	.......2.(...qt314/a4......qt314/al......a4.java...<clinit>...()V...a...java/lang/Exception......qt314/aJ......Ljava/lang/Process;.............llllIIlIIII...(Ljava/lang/Object;)Z.............java/lang/Process......destroy...................java/lang/String......length...()I.............<init>..!......"...Code...StackMapTable...Exceptions...SourceFile.!...................$..........................$...I.......(........!.......... W.n.X..s.E...~.............&.....%......f.....&...........!.....$..............#..............$...!......................%.......@....'......

C:\jar\qt314\a5.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	679
Entropy (8bit):	5.192362547982798
Encrypted:	false
SSDEEP:	12:y/USBTb6AM3UnROM2Uhs9gpym7Mcnpm1zka4Dvlo4lAV4l3Hluqy7UFcy7zBs1Cn:ysob6WnwN9gpym3pm1zEBlTao9zBs1C
MD5:	7CEBBC4873B941DE1D5970EDA30C31A0
SHA1:	387F370B4B87F6E0CD6C7512B78C59E472F78E18
SHA-256:	8885A7C81926D3C4E2A0C698AE852DF45AA16F7305BEDE7522F3E55A7EF1C671
SHA-512:	221464594005C9A911C2DF79913705A12CE5C4221546CBC215213411035A87F79B5AC29A993C87A7F5484E1FF8968CC1D5B357735ACDD8B1F1FF38D95FA6E253
Malicious:	false
Preview:	.......2.2...qt314/a5......qt314/al......a5.java...<init>...()V.............lIIIIIllIIIl...(I)Z...a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/io/File......(Ljava/lang/String;)V.............exists...()Z.......................delete.. ......!.....#...java/lang/String..%...length...()I..'.(..&.)... ..+...<clinit>...Code...StackMapTable...Exceptions...SourceFile.!.....................................................!......................./.......@......................O...L...Y+...M,........:,..".$..X.$..W.......$.G..........5.V...,..t.~...........!.M...../........M.......&..........0...........-..........................1......

C:\jar\qt314\a6.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.5792034384747256
Encrypted:	false
SSDEEP:	6:MmA0wszG3klk9EQnrL6NwE1w04T2vTlozU8lomMdZ2liFvl:VoSBkFnap1t46blo48loRZzd
MD5:	6BD2DCA49443445D24649C321515CF71
SHA1:	149B5F33C8210EC758C509883DFD74EF18DA951A
SHA-256:	8B88F72E5057879F73AEBC17EA384D592B1D24DBF8489A47D5CC5B822C5BBE04
SHA-512:	803161600A94E4EB1F6F62FDEFDAF7BCC56D3564E363B3D594F6C33CD696F59EFF49C4E19E201415365E8CF24C4DD9A5532B929431B35E8705A88BB089C375D7
Malicious:	false
Preview:	.......2.....qt314/a6......qt314/al......a6.java...<init>...()V.............a...java/lang/Exception......java/lang/System......exit...(I)V.............<clinit>...Code...Exceptions...SourceFile.!................................*......................................................................................

C:\jar\qt314\a7.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	634
Entropy (8bit):	5.247595091945712
Encrypted:	false
SSDEEP:	12:FKYGNM3oCdQiR47sjMH/sTjlm7Mcnp7Ftrzka46rzSOOlorHb/abYl1D+vDl6:Fv7Zq7EZm3pbrzXK9Yl16vk
MD5:	50C3AFEBD461747379C2B6D459297819
SHA1:	D9673C09A5D87F00ABF2A12A66B66E9997813FB1
SHA-256:	25C7A3CCF7309917AAF79EF124C698138ADC3993F084B664103FE7B631067C65
SHA-512:	8487995F215F2CB67AAB1AEA547A8D580C7060A5D299A212D0ED8F4A761F858B16B91C3F7809ECCEB0A290C611AF92501501624A56347A017A172B05684A1921
Malicious:	false
Preview:	.......2.1...qt314/a7......qt314/al......a7.java...<clinit>...()V...<init>.............a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/awt/Desktop......getDesktop...()Ljava/awt/Desktop;.............java/net/URI......(Ljava/lang/String;)V.............browse...(Ljava/net/URI;)V.... ....!.....#...java/lang/String..%...length...()I..'.(..&.)... ..+...Code...StackMapTable...Exceptions...SourceFile.!...................-..........................-.............................-...a.......4...L......Y+.....".$..W................~.,..*....M........2..............2.......&......./...........0......

C:\jar\qt314\a8.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1855
Entropy (8bit):	5.62860695075638
Encrypted:	false
SSDEEP:	48:FdEK8KqjGA/4xU3EAxyDPMGhi1V+3i4v9XuWaUyovn:4dSs/UA4P1iqXFXaUy0
MD5:	DBB6127581F2AF38E5E499E4D7C62BE2
SHA1:	57C4077C1EC21BBD3C09E112668ABD8159C8C21C
SHA-256:	D7A275B702FE0C259E0CB93270F30C2EAFAC0E88DAC09241656683E806E3F39E
SHA-512:	52EA68DCF846347207EDD4106C9C806045B0DA3EB6B151CC811A09B29C5098BE6B461820355A7DE3865C79712916D2B65847F1CF4AF617FADF5DFAFBE5D4ECC0
Malicious:	false
Preview:	.......2.\|...qt314/a8......qt314/u......a8.java...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......I.............java/awt/GraphicsEnvironment......getLocalGraphicsEnvironment.. ()Ljava/awt/GraphicsEnvironment;.............getScreenDevices...()[Ljava/awt/GraphicsDevice;.............java/io/DataOutputStream......writeInt...(I)V.............llIllIlIIIl...(I)Z.............java/awt/Robot..!...<init>...(Ljava/awt/GraphicsDevice;)V..#.$..".%...java/awt/GraphicsDevice..'...getDefaultConfiguration.."()Ljava/awt/GraphicsConfiguration;..).*..(.+...java/awt/GraphicsConfiguration..-...getBounds...()Ljava/awt/Rectangle;../.0....1...java/awt/Rectangle..3...x..5....4.6...y..8....4.9...createScreenCapture..4(Ljava/awt/Rectangle;)Ljava/awt/image/BufferedImage;..;.<..".=...qt314/cb..?..@(Ljava/awt/image/BufferedImage;II)Ljava/awt/image/BufferedImage;....A..@.B.....D...java/lang/String..F...length...()I..H.I..G.J.."(Ljava/awt/image/BufferedImage;)[B....L..@.M...qt314/c1..O...c...[B..

C:\jar\qt314\a9.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	5.474857861095377
Encrypted:	false
SSDEEP:	24:U7Un0apwtK4aQEWQizdZYBlrZzKMCi1iwnf43QfJznbCt:U7UnpVXQjQydCBVpKFi9f4jt
MD5:	85252B1898996A7FDCCD56FFD294DAC7
SHA1:	C810C661695B88E7A76876C36EFB2F457CA40616
SHA-256:	6E1D517E2752C9A0FFA0911B3B6FB1D16A3A792CF35392E6F6AFDB5E1077359D
SHA-512:	5CBE701F52CFA56BED22AB3D50E1D8ABA4EF72256F71DD011AD0485B903DBF230231DF2E364735D13C82EA4519CE21802F84A64C8F5DDB66FA3B145872D9EB86
Malicious:	false
Preview:	.......2.N...qt314/a9......java/lang/Object......a9.java...<init>...()V.............lllIIllIllI...(I)Z...<clinit>...lllIIllIlll...(II)Z...a..9(JLjava/io/InputStream;Ljava/io/OutputStream;Lqt314/dt;)J...java/lang/Exception......qt314/cN......I.......................java/io/OutputStream......write...([BII)V............... ...java/lang/String.."...length...()I..$.%..#.&... ..(...(II)I........+...qt314/dt..-...(JJI)V..../....0...java/io/InputStream..2...read...([B)I..4.5..3.6.........8...lllIIlllIII..:......;...[B..=...(Ljava/io/InputStream;Ljava/io/OutputStream;)J...(Ljava/io/InputStream;)[B...java/io/ByteArrayOutputStream..A..B......?....D...toByteArray...()[B..F.G..B.H...Code...StackMapTable...Exceptions...SourceFile.!...................J.............................J...!.......................K.......@..........J..........................J..."........................K.......@..........J...........n...6......:..6..7........<-.............a.!..'W.)..'.)..'......7.............,..1..,.

C:\jar\qt314\aA.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3705
Entropy (8bit):	5.871863476918181
Encrypted:	false
SSDEEP:	48:pgVdHrh7EXeMlMUvWA5YIzF3nVXvCKzIleDFUTJz1Ff3sKSEbtq1V3WpEPnbsA:y35EXet/A6IzJVfGl/pPZ5btqHnbsA
MD5:	7E2906149D26A2F47900437F46188A0E
SHA1:	CABEB6C9C40D9AB9B3ABE58F3E8232B100A6B837
SHA-256:	D5D198B143C8EFC37D417CAB543058CD76FC6F77E4F90F12CBA182960D6F354F
SHA-512:	328CA151090681EAC821A42CFB6139C84F2F4325569B066E32A20807E28572768B7CBC2665EA38AE16A988A24EA7BFD0E1F39429C88CD7BF0B27F767AD766F48
Malicious:	false
Preview:	.......2.....qt314/aa......qt314/al......aa.java...z...[Ljava/lang/String;...lllIlIlIII...lIIlIlllllII...(I)Z...lIIlIlllIlII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............java/lang/String......getBytes...(Ljava/nio/charset/Charset;)[B..!.".. .#...digest...([B)[B..%.&....'...Blowfish..)...<init>...([BLjava/lang/String;)V..+.,....-...javax/crypto/Cipher../..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....1..0.2...init...(ILjava/security/Key;)V..4.5..0.6...java/util/Base64..8...getDecoder...()Ljava/util/Base64$Decoder;..:.;..9.<...java/util/Base64$Decoder..>...decode..@.&..?.A...doFinal..C.&..0.D...([BLjava/nio/charset/Charset;)V..+.F.. .G...printStackTrace...()V..I.J....K...key...Ljava/lang/String;...keySpec..!Lja

C:\jar\qt314\aB.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	445
Entropy (8bit):	4.895882819984659
Encrypted:	false
SSDEEP:	12:Clmciv7/MONSMnbv1tZ541t4gl4EO/4yb/zsiw1on:CljmBz3ZW1/O//brs/on
MD5:	85A26F43DDE0B16A960C064CC82AA78A
SHA1:	B4B51C89EDE86C3A5E89129774523FFCDFC2E22F
SHA-256:	8D11C48B2556824A520E6202470B73748EEE0D95C53939360D5C4FDC7172AA5F
SHA-512:	17A5E0164E6C4F382E39DE8702FE2FE1737E594D279B9D7413E7B6615C40C10EE2927779E90E0A0838D5D40F700F11C774F56C3A52E742F2F0179EFB0EA7081E
Malicious:	false
Preview:	.......2.....qt314/ab......qt314/u......ab.java...b...Ljava/lang/String;...<init>...(Ljava/lang/String;)V...()V.......................a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/cS................()B...<clinit>...Code...Exceptions...SourceFile.!...........................................+..............................,*..............................................2..........................................

C:\jar\qt314\aC.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2816
Entropy (8bit):	5.774449523082081
Encrypted:	false
SSDEEP:	48:ZRlRcCcvrorHbPtDEd0/WVPvvfUl3UummQCWKyr5T0YoZMTqi:ZRlOpv0EdIWVPvUlEAWj5qZo
MD5:	27B04E6F5F9C164E00485FC38AF09210
SHA1:	62870985509A6A6368289E22F15731F72A25E3AA
SHA-256:	F4AB67A97EC044F5D5D6BC0DDDF62703F3B1FF30E113295854C5B8166F65BED3
SHA-512:	2C5D4BE0D8377DA5A03DEF2EE9D38046470ACF97B941327D60378BD7700972BFCEB924DB33107BCAE4A3CC09CA03EFE83092B601059A3195168537FF70A22C89
Malicious:	false
Preview:	.......2.....qt314/ac......qt314/al......ac.java...lllIlIlllI...[Ljava/lang/String;...z...Ljava/lang/String;...lIIllIIIllII...()V...java/lang/String................VCd3fSxIOGwnLV8qIiQk......fvtUr......lIIllIIIlIll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............<clinit>...................length...()I...................!... ..#...toCharArray...()[C..%.&....'... ..)...lIIllIIllIIl...(II)Z..+.,....-...<init>...([C)V../.0....1...intern...()Ljava/lang/String;..3.4....5...[C..7../......9...java/util/Base64..;...getDecoder...()Ljava/util/Base64$Decoder;..=.>..<.?..!java/nio/charset/StandardCharsets..A...UTF_8...Ljava/nio/charset/Charset;..C.D..B.E...getBytes...(Ljava/nio/charset/Charset;)[B..G.H....I...java/util/Base64$Decoder..K...decode...([B)[B..M.N..L.O...([BLjava/nio/charset/Charset;)V../.Q....R...java/lang/StringBuilder..T..U.9...lIIllIIllIlI..W.,....X...append...(C)Ljava/lang/StringBuilder;..Z.[..U.\... ..^...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..`

C:\jar\qt314\aD.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	5243
Entropy (8bit):	5.9876799732775385
Encrypted:	false
SSDEEP:	96:3Q1IRkEys31IXn7EoYqSVraRlnycKMxKr2NdA8/2LpGnmxVmmo+:A1Mkq3unQqSalytDaDHsmh+
MD5:	5F23F0C545ACC69462DDFAF06FFAC1DA
SHA1:	103135005047292B3D5F4FCF168BA2A3E4E09E5B
SHA-256:	4B492D9EAA891E027A046919F3C6B494BDDCC046EFDFEC89C4BB442A1D793467
SHA-512:	A0A54616DA15BCD835E0F00828BC17A5498898BFF815A18ACD16372706F3F37D7D3C429C5B376A0366339B5C7F60C47EF9FF40B5E8F1E45354CE5DC46FBE374E
Malicious:	false
Preview:	.......2.&...qt314/ad......qt314/al......ad.java...z...[Ljava/lang/String;...lllIlIIlII...a...()V...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.......................java/io/File......createTempFile..4(Ljava/lang/String;Ljava/lang/String;)Ljava/io/File;.............qt314/df......<init>.............k...Ljava/net/Socket;.. .!...."...g...Ljava/io/DataInputStream;..$.%....&...i...Ljava/io/DataOutputStream;..(.)....*...qt314/c1..,...()[B.......-./..a(Ljava/io/File;Ljava/net/Socket;Ljava/io/DataInputStream;Ljava/io/DataOutputStream;Lqt314/cW;[B)V....1....2...java/io/FileInputStream..4...(Ljava/io/File;)V....6..5.7...java/util/jar/JarInputStream..9...(Ljava/io/InputStream;)V....;..:.<...qt314/cF..>...java/lang/Object..@...getClass...()Ljava/lang/Class;..B.C..A.D...java/lang/Class..F...getClassLoader...()Ljava/lang/ClassLoader;..H.I..G.J..8(Ljava/lang/ClassLoader;Ljava/util/jar/JarInputStream;)V....L..?.M...close..O....5.P..:.P...java/util/jar/JarFile..S..T.7...qt314/aQ..V.

C:\jar\qt314\aI.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	5.663110125008689
Encrypted:	false
SSDEEP:	48:I6PPG0tRetcOmVUbLZ7fEAkWC6HlG+/Niozkwv5sx3jMAm:PG0D2cVUxEAkWnlGGkWOnm
MD5:	864CF8859CAC57433DA8FE7CE0FE68BB
SHA1:	FC046F80A795554DBC986A591AFDA8ACD7CA6F9C
SHA-256:	26E2875430F251F261C750E61E8410D11AE1AFBA46B83C912C3089B8A75F6907
SHA-512:	2F4AEEC7A9539F4424C4F42210314804B946412BD854CE5DAEAE596DA3EC01C477FD325B3D297D41BD798B5FFD80C9A36EBBB2D06228DE152394682553DB5C7F
Malicious:	false
Preview:	.......2.....qt314/ai......qt314/u......ai.java...llIIlllIlI...[Ljava/lang/String;...b...[Ljava/awt/GraphicsDevice;...<init>...([Ljava/awt/GraphicsDevice;)V...()V.......................lIIIIIllllll...(II)Z...lIIIIIlllllI...(I)Z...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......I.............java/io/DataOutputStream......writeInt...(I)V......... ........."...java/awt/GraphicsDevice..$...getDefaultConfiguration.."()Ljava/awt/GraphicsConfiguration;..&.'..%.(...java/awt/GraphicsConfiguration..*...getBounds...()Ljava/awt/Rectangle;..,.-..+.....getIDstring...()Ljava/lang/String;..0.1..%.2.........4...java/lang/String..6...startsWith...(Ljava/lang/String;)Z..8.9..7.:...length...()I..<.=..7.>...substring...(II)Ljava/lang/String;..@.A..7.B...qt314/cS..D...(Ljava/lang/String;)V....F..E.G...java/awt/Rectangle..I...x..K....J.L...y..N....J.O...width..Q....J.R...height..T....J.U.........W......()B...lIIIIlIIIIII...lIIIIIIlIIIl...Lw==..]...snAla.._...lIIIIIIlIIII..8(Ljava/lang/

C:\jar\qt314\aM.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	6.06407987267243
Encrypted:	false
SSDEEP:	192:H/KEH5wzuLBKnellfJRH8AIA6Oow3VqkTS+2UJP7aeJB:ftxLBHzDH8AIA6OoCAkT7Gc
MD5:	6371AB2B532246DC135FAA527448E58A
SHA1:	D13692469AC0DD332A7677D5D875AAF89DCC1D60
SHA-256:	45F703773A0D480A3AADA77CFA8CBD85E3F4EFFC7D9E849B1C2BD4F18F59EAC2
SHA-512:	4BA06DE23BAAD82FF0B3FC3E4DB2B390D2D68BFA773F5813C47C936486FA0A5C845FDA3517C205AEE9C4FAE86354137CA0D8759383E3815F841DCBD63A755C60
Malicious:	false
Preview:	.......2.....qt314/am......java/lang/Thread......am.java...b...Z...llIllllIII...[Ljava/lang/String;...a...Ljava/lang/String;...z...c...lIIIllIIllll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;......... ...java/lang/String.."...getBytes...(Ljava/nio/charset/Charset;)[B..$.%..#.&...digest...([B)[B..(.)....*...Blowfish..,...<init>...([BLjava/lang/String;)V..../....0...javax/crypto/Cipher..2..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....4..3.5...init...(ILjava/security/Key;)V..7.8..3.9...java/util/Base64..;...getDecoder...()Ljava/util/Base64$Decoder;..=.>..<.?...java/util/Base64$Decoder..A...decode..C.)..B.D...doFinal..F.)..3.G...([BLjava/nio/charset/Charset;)V....I..#.J...printStackTrace...()V..L.M....N...keySpec..!Ljavax/

C:\jar\qt314\aN.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.859202701188532
Encrypted:	false
SSDEEP:	6:ueB3wvkqzsWYyNsyLTv1o6+vIElh0w04Ts1lIM+ovSc+mWGw0Ut/QRRC:b2vB2yNs2v1thElh0t4gl4oCOcYRk
MD5:	D7F9E96EAD2B743234E314A3A7CA0FCF
SHA1:	BE76B9C44B0F182808B81043844AA20BB3A0A113
SHA-256:	AD54D7AF31D868E5089728A3DFF804A63CF8CA1CAEE96CE220166FBD7E473167
SHA-512:	ADFE1DB79E2979549A989E3CA569F6043F5E122A83AB946957C766A81D7E0A847DA4095E7C694A719CB971926C63267574581C700609166187B394933C9F9396
Malicious:	false
Preview:	.......2.....qt314/an......qt314/u......an.java...b...I...<clinit>...()V...a...()B...<init>...(I)V......................'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......java/io/DataOutputStream......writeInt.............Code...Exceptions...SourceFile.!....................................................................?.............................................................+*...............................

C:\jar\qt314\aO.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	5.8153921973520415
Encrypted:	false
SSDEEP:	48:i5Sra1a7PYjssiE/dx0wnFP7wPIlfU85Xtgd1XN2ole1O88x+fEbOlTqg:CJeE/dx0OVled1zyOxU80
MD5:	8423B11B930E4CA0120FA715442A0EE0
SHA1:	B8B71CA821AB75825942452EB57B722DA4BF50A4
SHA-256:	D2B723A75CDAAAF6759E53AA5F1FD3BEADA6B0BC73ACDF3EFAF97524D636F38B
SHA-512:	164633956E3B4A143406635C8AC3256591A2788786793B3C0426D3CB411D6AC7906063024766F25358C4FA13814B3F43FBD519599A6C8932E1BBD79D4E612EFE
Malicious:	false
Preview:	.......2.....qt314/ao......qt314/u......ao.java...z...Ljava/lang/String;...lllIIIllIl...[Ljava/lang/String;...b...lIIlIIIllllI...(II)Z...<init>...(Ljava/lang/String;)V...()V.......................<clinit>...lIIlIIIllIIl.............................java/lang/String......length...()I......... ... ..".........$...toCharArray...()[C..&.'....(... ..*...lIIlIIIlllIl..,......-...([C)V..../....0...intern...()Ljava/lang/String;..2.3....4...[C..6...lIIlIIIlllII...(I)Z...Nwsh..:...YvBvW..<...lIIlIIIllIII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;..>.?....@...a...()B...java/util/Base64..D...getDecoder...()Ljava/util/Base64$Decoder;..F.G..E.H..!java/nio/charset/StandardCharsets..J...UTF_8...Ljava/nio/charset/Charset;..L.M..K.N...getBytes...(Ljava/nio/charset/Charset;)[B..P.Q....R...java/util/Base64$Decoder..T...decode...([B)[B..V.W..U.X...([BLjava/nio/charset/Charset;)V....Z....[...java/lang/StringBuilder..]..^...........`...append...(C)Ljava/lang/StringBuilder;..b.c..^.d...valueOf

C:\jar\qt314\aP.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4745
Entropy (8bit):	5.814226507675286
Encrypted:	false
SSDEEP:	96:EZ98TIEAe59Y+HZR5LBt1lDfTVFCXQmyFr97J+gu3mL:up8HZR5FlDrjCB+rVMgcC
MD5:	640B2A1554555A38373C411D0C64994B
SHA1:	83ED61B7A0908261B5BDED327FE9C8B72AB4D1C5
SHA-256:	3EE0E7CEC5A2C5489DB5E9BCD72372C8491E6CDD22208DC14EF2F09D131F7924
SHA-512:	AC5C8C1DB3E3BE710126C57DE394897F7DF03F20143BDED7DEFF23DD83321B0B90E8F229064EDE853DDE54D7BA4CF878D31351A8CAD0E01413165765BD325F5E
Malicious:	false
Preview:	.......2.....qt314/ap......qt314/al......ap.java...z...[Ljava/lang/String;...llllIIIIIl...<clinit>...()V...lIIlllIIlIlI.............java/lang/String......................length...()I............. ................toCharArray...()[C............. .. ...lIIlllIllIII...(II)Z..".#....$...<init>...([C)V..&.'....(...intern...()Ljava/lang/String;..*.+....,......[C../...lIIlllIIlIII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception..3...javax/crypto/spec/SecretKeySpec..5...MD5..7...java/security/MessageDigest..9...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..;.<..:.=..!java/nio/charset/StandardCharsets..?...UTF_8...Ljava/nio/charset/Charset;..A.B..@.C...getBytes...(Ljava/nio/charset/Charset;)[B..E.F....G...digest...([B)[B..I.J..:.K...java/util/Arrays..M...copyOf...([BI)[B..O.P..N.Q...DES..S...([BLjava/lang/String;)V..&.U..6.V...javax/crypto/Cipher..X..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..;.Z..Y.[...init...(ILjava/security/Key;)V..].^..Y.

C:\jar\qt314\aR.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	805
Entropy (8bit):	5.183578861585118
Encrypted:	false
SSDEEP:	12:GpxqMOOv1tfpwm9okX8MMb9vxygLUYcMazka4glukx5bZwcV8+4lduqWclHHf:exX3tWZJJgzeg5bG28LdWUnf
MD5:	23417CF78760443FFFF207BBEDDE6A21
SHA1:	EFA7E539387F4B6B25B14709BBF471DC389AF852
SHA-256:	13A134C677C2C500F4556A21B81937A54EA698E56092B1692B7EBD8CCE2929C8
SHA-512:	C2B473EAD8B0CB729FD114C109EA74AEEA94E8F906B2A6525DBE79593398B99C2F98C9A2E29151E8FA53FADD1964DBC1007AC4865BED9F996B457468C41C0A61
Malicious:	false
Preview:	.......2.0...qt314/ar......qt314/u......ar.java...b...[Ljava/lang/String;...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......I.......................java/io/DataOutputStream......writeInt...(I)V.............lIIlIIlIllIl...(I)Z.............qt314/cS......(Ljava/lang/String;)V.............lIIlIIlIlllI...(II)Z.. .!...."......()B...<clinit>...()V...<init>...([Ljava/lang/String;)V..(.'.......Code...StackMapTable...Exceptions...SourceFile.!...........................,...j.......>...6.+..........Y:..6..6.............2N,-..............#........-........#................$...................%...,.............6..............,...!.......................-.......@....&.'...,....................(.)...,..............+*+........... .!...,..."........................-.......@..../......

C:\jar\qt314\aT.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	635
Entropy (8bit):	5.067187330523283
Encrypted:	false
SSDEEP:	12:Yih8s/MOcTyv1tMDAM5JtHYYMaMaMaMHt4OKlv2PEF/GChTHn:YihTYTq3Oc1almEFlhD
MD5:	272F91FC092917CD86E715AF6E4C3259
SHA1:	4BEABF2231A7054224E4276A340186F2374D46F6
SHA-256:	6EFE331EDABB135C75DB550C459DC456CC5C1568FEA0717A6B2A669A4A625B76
SHA-512:	D58E5DAFBD1E6999840DC63D788661C82F51013C0B62895C9E082B0CC1F742BFB66AAF1097F2E7BFB06680E8643266B3EAB187126FD4DDCAB1EBD59A36C95F08
Malicious:	false
Preview:	.......2.&...qt314/at......qt314/u......at.java...b...Ljava/lang/String;...c...e...d...a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V...........................................<clinit>...()V...<init>..K(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V.........!...Code...Exceptions...SourceFile.!...................................................#.............0..............#...5.......),........,........,........,..............$.................#...................... ...#...&.........."+...,...-...*.............%......

C:\jar\qt314\aY.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.704423089777254
Encrypted:	false
SSDEEP:	6:M0zR0E783szG3klSXXdVtHE+YJw04T2vTlozUKlXvvlok6VD2:pzUSBS7tTYJt46blo4KlX3lokmD2
MD5:	738B8E71A54350BB8B2DAC87E79CA0DA
SHA1:	AD1BEDC5C926B2925EDAFC7E061589DADA7BFD10
SHA-256:	ECC5F02DFEA3E8FC8FC62935E6D6C3155714C6A31C51DD71FEFFBE7937D511E0
SHA-512:	DA63EC189E37BD210777EADF3EE0B0B3AD53F53555FE9D5F8465C25B5FD3AD38679A7C14BCED6E80C8ED69480A176DC581CF6D7593C7EE7333B34D001D7BFB2A
Malicious:	false
Preview:	.......2.....qt314/ay......qt314/al......ay.java...<init>...()V.............<clinit>...a...java/lang/Exception......qt314/m......b...[Ljava/awt/image/BufferedImage;.............Code...Exceptions...SourceFile.!................................*......................................................................................

C:\jar\qt314\aZ.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.226026257775083
Encrypted:	false
SSDEEP:	3:DbllJlmd3iBmRdELPETErbHezslM4RMlAkvB8KQXXReT/lln3l90q/l1lylCkllQ:TSSBSsvrqzsW4GRbQ4T30OvyNloJlA6n
MD5:	8B10C46177D32C6CE97522919FDBF117
SHA1:	4F7F64ED0804C4BABC7819C365474806BED286D7
SHA-256:	5AFC5ADC4B61F07537D41C742DB63BA28A07262A9291594D6C6AA4C257AEF501
SHA-512:	386818FC515E68125C56C9791ED6FA1D12B0E6A4687606977F72B5F5F833823D5C7B12AA637DDA68E3D254352E9AFED20A72823F0D8D5D63C44B3B568641CAC6
Malicious:	false
Preview:	.......2.....qt314/az......qt314/aF......az.java...<clinit>...()V...<init>.............Code...SourceFile.!...........................................................*..................

C:\jar\qt314\a_.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	310
Entropy (8bit):	4.53621460977382
Encrypted:	false
SSDEEP:	6:M4R0xszG3klk9ESHTiXwE1w04T2vTlozUgMuADlZ2liFvl:rqSBk3iX1t46blo4ruADlZzd
MD5:	4A6AEDB6983880A38D714B8C6F7AB769
SHA1:	9E1F89734A7539947620582C414A1B1D00541A60
SHA-256:	71C95BFF3BBAE771ED157CE5F6E1C2448A92C9C9FEFFE36CCA5E41317AB40A29
SHA-512:	C1B6E5B81DA160D52837B715055201755DEDE1F5208E765B4744FFF26A1BA493B7180447DEFBA57B203C87C9948CEAD815316763EDEC477CE6F54ED6824CFE74
Malicious:	false
Preview:	.......2.....qt314/a_......qt314/al......a_.java...<init>...()V.............a...java/lang/Exception......qt314/aJ...........start.............<clinit>...Code...Exceptions...SourceFile.!................................*.................................Y..........................................................

C:\jar\qt314\ae.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	524
Entropy (8bit):	4.995290932991188
Encrypted:	false
SSDEEP:	12:Wm/MOcUv1tQMtJfYYkMaMSm40t4Fl/cH0Vm8lktzPXjg:tYU3zJRcm40slW0s4
MD5:	812EF98C4B4CBE5C1D7A89E1C3CDE436
SHA1:	489780327D6E9140D7501DB86A6C25C856344134
SHA-256:	3C7FCBEA3897E94AF0F878F52A7BD08CC3201E351F48924875627FA6C3C753FC
SHA-512:	90CFBF71B768EE1DDF4980ECD75F7BAE9C3342A9193A0D363407F2831A167535E37EB4AE11B8C9F6A27768C0C816CF665E6FDA1B1D94BFAD460789EC43F206D5
Malicious:	false
Preview:	.......2. ...qt314/aE......qt314/u......aE.java...b...Ljava/lang/String;...c...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.......................<clinit>...()V...<init>..'(Ljava/lang/String;Ljava/lang/String;)V.............()B...Code...Exceptions...SourceFile.!.......................................!........,........,...........................................................................+...,..............................................

C:\jar\qt314\af.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.836373101887188
Encrypted:	false
SSDEEP:	12:fvkOo6J62+V4+NNNpsF31t4g2Q+Ll4bd1gJlojlIN07:XkZ6E2Hko16Tybd16+z7
MD5:	7716B6C981B62BF9A440851BEABE7629
SHA1:	919ADCC02D0B66A83B824DE57CFD8236CE415EC9
SHA-256:	D214DEB43756E18C1F835878E12BE648C6FEE74F7284EEDB46A7EDBAB46857CA
SHA-512:	297F51B2F64EBD986C6343B012B2BE14B0A587E73A3923FD0A3E968334D9922B97AACE88FEA42DAFB5DBDF5553948B1204D454EE57E15A2F78FFD1197C90429B
Malicious:	false
Preview:	.......2.!...qt314/aF......qt314/al......aF.java...c...Z...a...()V...java/lang/Exception......qt314/cd......e...()I.............qt314/m......<init>...(IIIII)V.............run.......................<clinit>...Code...Exceptions...SourceFile.!...............................4.......(...<...=...>...6....6....Y..................................................*...................................... ......

C:\jar\qt314\ag.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.366060638850814
Encrypted:	false
SSDEEP:	12:5+N0E6Jov1tzp8XgdY9cM3MvfkMvq+bSHLk9tn1zka4glukOxWc+d4lIql5uBpGN:5+f73F8IRq+2q1zeDWcaqlYBILSzB3O/
MD5:	1B4A102002D92B5A03E15FCA7944AC13
SHA1:	9829380A1FC30A0721F86427A8343B2EACB33827
SHA-256:	FD4D58A6928B269A9FFEEC4ABF7B70B30E81BB8C551F54D4FDE4F9E63B61C0D4
SHA-512:	4C400A626F51F3CF44D14CF924648949A5E01809BC081687787792ACC93D0904E6EF4F44999D286938B233E0747D9E06A994D957234194F45D66199BAFAC4C69
Malicious:	false
Preview:	.......2.E...qt314/aG......qt314/u......aG.java...b...[Ljava/io/File;...a...()B...lIIlIlIlllll...(II)Z...lIIlIlIllllI...(I)Z...<init>...([Ljava/io/File;)V...()V......................'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......I.............java/io/DataOutputStream......writeInt...(I)V...................!...java/io/File..#...getAbsolutePath...()Ljava/lang/String;..%.&..$.'...qt314/cS..)...(Ljava/lang/String;)V....+...,...getTotalSpace...()J..../..$.0............writeShort..4......5...getFreeSpace..7./..$.8...getUsableSpace..:./..$.;.........=......<clinit>...Code...StackMapTable...Exceptions...SourceFile.!...........................A.............>..............A..."........................B.......@..........A...!.......................B.......@..........A...............+.................A...............6.+...... ...Y:..6..6....."..U....2N,-..(..-..+-..1..2m..2m..2m...6+-..9..2m..2m..2m...6+-..<..2m..2m..2m...6.........>.........B........#...............?...

C:\jar\qt314\ah.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	445
Entropy (8bit):	4.898456408811011
Encrypted:	false
SSDEEP:	12:ClmB/MONSMnQv1tYxvh1t4gl4EO/6Y1XB/yh0Yn:ClSBg3YNh1/O/6IXB6ln
MD5:	95B5376EAB50BC15CF3884F0ABC5B4B6
SHA1:	9F4EBE121F14ED57C048E843C589B71B74F5357B
SHA-256:	77B3399AE9214450E19A6E108045D5824DA72F010DC58F44727926A299B33C88
SHA-512:	A0F7EE6165FEA9257F3532DF6D2C7199AE64AD9AE0D7308D8BDB6D441AD6B0D61B01AE049CACD66EB17F515A5E97A4B138651E232969405C9ACE1150EB385D62
Malicious:	false
Preview:	.......2.....qt314/aH......qt314/u......aH.java...b...Ljava/lang/String;...<init>...(Ljava/lang/String;)V...()V.......................<clinit>...a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/cS................Code...Exceptions...SourceFile.!...........................................+..........................................................<...........................,*.................................

C:\jar\qt314\aj.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4969
Entropy (8bit):	5.912971401423208
Encrypted:	false
SSDEEP:	48:l7fd5vdDRRGXIM8pgAF6pRqrR+MEfeNnEHedHBBmURBrUA8IlM0KAuh/4Yvmqb/n:3vnmII+FEHe5BBrHlcA4Vv3b/O7G0F9y
MD5:	EAB0A562A14A210B71F0746C6785F0BB
SHA1:	990468DB640570674BC060CF867188390B1D811D
SHA-256:	135478A367ACF0165D6668CF466E2C74D4CEBCD425D158D97DA9B59A26DE0793
SHA-512:	5046DD856D5E290A7330946DD6FC6C14F8F8C0A0B1B28DC09A861448B763D9A0468A638BDCFE31573217B4DE0BB8AD70B7EEF1C57E7AE6F69A4C76346798E269
Malicious:	false
Preview:	.......2.....qt314/aJ......java/lang/Thread......aJ.java...a...Ljava/lang/Process;...z...[Ljava/lang/String;...lllIIllIlI...lIIllIIlIlII...(I)Z...lIIllIIlIIll..'(Ljava/lang/Object;Ljava/lang/Object;)Z...run...()V...java/lang/Exception......qt314/cd......e...I.............qt314/ah......getOperatingSystem...()Lqt314/ah;.............WINDOWS...Lqt314/ah;.... ....!.........#...java/lang/Runtime..%...getRuntime...()Ljava/lang/Runtime;..'.(..&.).........+...exec..'(Ljava/lang/String;)Ljava/lang/Process;..-....&./.........1.........3.....5...java/lang/String..7...length...()I..9.:..8.;...java/lang/ProcessBuilder..=...<init>...([Ljava/lang/String;)V..?.@..>.A...redirectErrorStream...(Z)Ljava/lang/ProcessBuilder;..C.D..>.E...start...()Ljava/lang/Process;..G.H..>.I...java/io/BufferedReader..K...java/io/InputStreamReader..M...java/lang/Process..O...getInputStream...()Ljava/io/InputStream;..Q.R..P.S...(Ljava/io/InputStream;)V..?.U..N.V...(Ljava/io/Reader;)V..?.X..L.Y... ..[...trim...()Ljava/lang/St

C:\jar\qt314\ak.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	836
Entropy (8bit):	5.184948254562881
Encrypted:	false
SSDEEP:	24:gqjSrZEHEhW1sn1zKj9B0lFBlE4d5lKg4:gKSrZEHEI1sB+9BcyklKg4
MD5:	0CED10D1E45C57AB9F6331BA8175C403
SHA1:	D1BE87BD3B9290835720F8D77E49601EFFFA8AA9
SHA-256:	396C21E2912EB28319542F3D66EFB49E31066B6E5170ACE5640A1CEF06EB2D7C
SHA-512:	D9F44184702962C9C8501E9857586DBFE522A1CC795BFFA98372665400B1483C731CDF007D82BB5051C8D4723D85D18EE68C231ED9A3143731B58A5486B4152E
Malicious:	false
Preview:	.......2.A...qt314/aK......qt314/al......aK.java...<init>...()V.............a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/lang/String......length...()I.............lIIIlIllllIl...(I)Z.............java/io/File......listRoots...()[Ljava/io/File;.... ....!...qt314/aF..#...c...Z..%.&..$.'...lIIIlIlllllI..).........(Ljava/lang/String;)V....,....-...listFiles../. ....0...qt314/D..2...([Ljava/io/File;)V....4..3.5...(Lqt314/u;)V....7....8...[Ljava/io/File;..:...<clinit>...Code...StackMapTable...Exceptions...SourceFile.!...................=.............................=...S.......3...L+..........."M..(..+......Y+.....1M..3Y,..6..9......>.................;.?...........<.....=....................).....=...!.......................>.......@..........=...!.......................>.......@....@......

C:\jar\qt314\al.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.432782872844771
Encrypted:	false
SSDEEP:	6:AlmdqS0dvlso6vt0ksourrkpwE1w04T2vyvslqMlHWvlorc/5sa1vO:A7jF6vtKrs1t46dqEHWvloARh1G
MD5:	274DF5C4AE679F69EDCA43A87DB79129
SHA1:	9E669DF32F106E8DA29503B699333FD71B7694B6
SHA-256:	FA6641FC017BCCA4D536FD2FB2E4E855FA0D50B7CB850E6A8E689C48E8FFCB53
SHA-512:	D1B474D70088958F18DCB5679A27F03B4FD81614541E6495A4F65B64624B19B5F1B11679B3D8A5B52DA998F21632F11FB94783662E64AC466D239E42B387C3A4
Malicious:	false
Preview:	.......2.....qt314/aL......qt314/al......aL.java...a...()V...java/lang/Exception......qt314/cd......g.............<init>.............<clinit>...Code...Exceptions...SourceFile.!........................................................................*.............................................

C:\jar\qt314\aq.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4929
Entropy (8bit):	5.908057697290519
Encrypted:	false
SSDEEP:	96:iFddPwE+eZehMDcXYK9BVlIQZ+Zt76GiUr3r1v/Dv:RrMDcXJ9BVlIE+PHr1v/z
MD5:	36A715BB33A59E325BD6FBDED0F971EC
SHA1:	1F176228BDA811AC46E1EBDC75BF1D4317C0448E
SHA-256:	EEDC12D548D356680DB42A52682B9E9B93EC46CD1B8DD91E01F0AA5073247D3A
SHA-512:	25B1FAED56D3452FFC00C82CDF5CD34A541297955F83672A7F3A4DEC8830C454862285622F692B594C4C0DAEA8CE50D3BF6FF7146DCE793C66545BDC635DE0AD
Malicious:	false
Preview:	.......2.....qt314/aQ......java/lang/Object......aQ.java...z...[Ljava/lang/String;...llIllIIIlI...lIIIlIIlIlll...()V...java/lang/String............... le0rRw/ZO+byvEVjDIEQ7TW4NExyW+8y......tFZBz......lIIIlIIlIlIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............CO/GA+YhrH4zigkEUkd8PQ==......zZJeP......hZpev7TsN64UtynxYMKaug==......JcEJl......lIIIlIIlIllI......... ...lIIIlIIlllII...(I)Z...java/lang/Exception..$...javax/crypto/spec/SecretKeySpec..&...MD5..(...java/security/MessageDigest..*...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..,.-..+....!java/nio/charset/StandardCharsets..0...UTF_8...Ljava/nio/charset/Charset;..2.3..1.4...getBytes...(Ljava/nio/charset/Charset;)[B..6.7....8...digest...([B)[B..:.;..+.<...java/util/Arrays..>...copyOf...([BI)[B..@.A..?.B...DES..D...<init>...([BLjava/lang/String;)V..F.G..'.H...javax/crypto/Cipher..J..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..,.L..K.M...init...(ILjava/security/Key;)V..O.P..K.Q...java/util/Ba

C:\jar\qt314\as.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	870
Entropy (8bit):	5.172325705718312
Encrypted:	false
SSDEEP:	12:yVqMO5YcM8JogN7yv1tZknoM3qq7M+zka4gla+s1/cHNwnAV4l3RutglyRKPin:EDEu3Urzq+s1YGRutglyoa
MD5:	7F911E89FF30745EE436057A5F2B0D24
SHA1:	C72EEFFB8215A31EC4AA25E15496B7827B4FF47E
SHA-256:	C3EAADD32ABC99DAAC86B6930E75CB97C23503D3A4AF956303934339DA98B5D0
SHA-512:	A21F49506D0589419C45972D23A7D96F94A983DA4DDB15D3ADA99B8B50F5BB83AFD8CA876B3C57F181B02908A20938ABE8BE8517CD233D2A991ECCA5389B2442
Malicious:	false
Preview:	.......2.2...qt314/aS......qt314/u......aS.java...b...[Ljava/lang/String;...<clinit>...()V...<init>...([Ljava/lang/String;)V.......................lIIlIIllIlII...(II)Z...a...()B...lIIlIIllIIll...(I)Z..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......I.............java/io/DataOutputStream......writeInt...(I)V......... ........."...qt314/cS..$...(Ljava/lang/String;)V....&..%.'.........)......java/lang/String..,...Code...StackMapTable...Exceptions...SourceFile.!......................................................................+....................."......................../.......@........................5..................!......................./.......@..............j.......>...6.+......!...Y:..6..6.....#.......2N,-..(.................../........#..........%.....+.....0.............&...................*...-Y.+S...........1......

C:\jar\qt314\au.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	635
Entropy (8bit):	5.07627437209391
Encrypted:	false
SSDEEP:	12:b/MOHv1tYAMVLXtHYYMaMaMaMHt4OKlv2P/F/GChTvtO/tun:bL3Ye1alm/FlhA/tu
MD5:	3F27867965BB49995CE537506B0515C7
SHA1:	2A489D12B92C89865DA809EE868A298B207B84CA
SHA-256:	AA6FDB1DDC0F81BA6FF31A4EE983F5D30B67EF983F996ABF1FBF6E5669A1D0E0
SHA-512:	9AC73DEA287D4F78EC432B81C26487815C8B2109ED8AC0C6FC844E4E357E4F1087D98B61A7769F1405B1D2C9FD010A8DD1182EDF0FCB296DFFACA9DBDC3C6E23
Malicious:	false
Preview:	.......2.&...qt314/aU......qt314/u......aU.java...b...Ljava/lang/String;...d...e...c...a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V...........................................<clinit>...()V...<init>..K(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V.........!...Code...Exceptions...SourceFile.!...................................................#.............3..............#...5.......),........,........,........,..............$.................#...................... ...#...&.........."+...,...-...*.............%......

C:\jar\qt314\av.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2706
Entropy (8bit):	5.6252957957382375
Encrypted:	false
SSDEEP:	48:6vZ4q81tzjEXeDHhJl6TZEe5WYKtEIl32GyKz7ajTeyu+:eyEXeLhKFc/lGJK3QZZ
MD5:	AFB58841BDBFBD995769BCBB76E8052F
SHA1:	4F11D9E68E56937EA166AA346F68DFE0A05F41DB
SHA-256:	75937500D34A2C2012B3844E628A53B3A810C3360919F883CB57930EDC82FB71
SHA-512:	10A0B592028419C43E96E7FB60C6C867BA510CACA9FF72E87F87C13BEA6A1FE56366BC190630023BF4BBE44109F01C96B78DDFE30D553E4234C7FB2916522233
Malicious:	false
Preview:	.......2.....qt314/aV......qt314/u......aV.java...lllIlllIIl...[Ljava/lang/String;...b...Ljava/util/Map;...lIIllIllIllI...(I)Z...<init>...(Ljava/util/Map;)V...()V.......................lIIllIlIllll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets..!...UTF_8...Ljava/nio/charset/Charset;..#.$..".%...java/lang/String..'...getBytes...(Ljava/nio/charset/Charset;)[B..).*..(.+...digest...([B)[B..-....../...java/util/Arrays..1...copyOf...([BI)[B..3.4..2.5...DES..7...([BLjava/lang/String;)V....9....:...javax/crypto/Cipher..<..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....>..=.?...init...(ILjava/security/Key;)V..A.B..=.C...java/util/Base64..E...getDecoder...()Ljava/util/Base64$Decoder;..G.H..F.I...java/util/Base64$Decoder..K...decode..M....L.N...doFinal..P....=.Q...([BLjava

C:\jar\qt314\aw.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	5.42441520493456
Encrypted:	false
SSDEEP:	12:NnbM30DXSMt1cdLUQ7MccnxaRWplJCIMaMSHvV1tv4RhUdchjPGovXrzka4tca3X:rTPe/CxaRWLFSKc4ErzramPjT257a/q
MD5:	221EC8725BF596E8D1EAB219D0F24C10
SHA1:	95BB516461709F7BCA20C8D3DFC996D09CE3AD6E
SHA-256:	C19C75E882853A69D113C1570F9EA3EA340B28EA6AE2C5F8057E757796968F2E
SHA-512:	A0D08F1CC33924F8E60E2894475630880420C36FC9D899E505FEA0C46DCDD3E43D2CB212A8EBFE06F1648833605D180A56E8B442C97253DD1A9D18F23D8E8675
Malicious:	false
Preview:	.......2.Z...qt314/aW......qt314/al......aW.java...<clinit>...()V...a...java/lang/Exception......java/io/File......qt314/cd......d...()Ljava/lang/String;.............<init>...(Ljava/lang/String;)V.............exists...()Z.............lIIIIlIllIIl...(I)Z.............isFile......... ....."...java/lang/String..$...length...()I..&.'..%.(... ..*...qt314/O..,...getName........./...getAbsolutePath..1......2..'(Ljava/lang/String;Ljava/lang/String;)V....4..-.5...(Lqt314/u;)V....7....8...qt314/df..:.......;.<...k...Ljava/net/Socket;..>.?....@...i...Ljava/io/DataOutputStream;..B.C....D...g...Ljava/io/DataInputStream;..F.G....H...qt314/c1..J...()[B....L..K.M..a(Ljava/io/File;Ljava/net/Socket;Ljava/io/DataOutputStream;Ljava/io/DataInputStream;Lqt314/cW;[B)V....O..;.P...f..R......S....<...Code...StackMapTable...Exceptions...SourceFile.!...................V..........................V..........._...Y......L+........L+..!.....B.#..)W.+..).......-Y+..0+..3..6..9..;Y..=M,+..A..E..I...N..Q..T............

C:\jar\qt314\ax.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	819
Entropy (8bit):	5.336217319777591
Encrypted:	false
SSDEEP:	12:7X8CLUzkwiw9UDvXM34FkM9+sMS7MnnxXl0qB/MaMkwXPzka4tGOn/FAuwsIi2Gq:rRtFokvD9MSexCqmfzbOthwxdwWryPJ6
MD5:	520B74C88A91D060E30F3451450EFCA4
SHA1:	D7F4A1D26F0E2D80A421F83D7120805C8D67828E
SHA-256:	8130834C586604EF795F605141E601552FF6DAC71118F30F30BD7BFEEEF831F8
SHA-512:	97EB39BE58F02C168C24ED7B522DDBE7974DA2C2166ECC1BB0E69C3553A3221AF75CC24C29B3FA174B52DA2A2708F587C02B77676E5E38F43FB303E3CF89B564
Malicious:	false
Preview:	.......2.=...qt314/aX......qt314/al......aX.java...<clinit>...()V...a...java/lang/Exception......qt314/cd......()Z.............lIIIllIIllII...(I)Z.............javax/swing/UIManager......getSystemLookAndFeelClassName...()Ljava/lang/String;.............setLookAndFeel...(Ljava/lang/String;)V...................java/lang/String.. ...length...()I..".#..!.$... ..&...e..(.#....)...d..+......,...qt314/cp......<init>..2(Lqt314/aX;Ljava/lang/String;Ljava/lang/String;I)V..0.1../.2...start..4..../.5..0......7...Code...StackMapTable...Exceptions...SourceFile.!...................9..........................9...v.......K...<......&..........%W.'..%........m...........=..-N..-:.../Y..-...3..6........-.....:........-.............;...........0.....9............*..8..............9...!.......................:.......@....<......

C:\jar\qt314\b0.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	404
Entropy (8bit):	4.89347380903415
Encrypted:	false
SSDEEP:	12:WEc6vt/krII2ybEOITEZ8klz1t46bmMw8T6lohHzOzg:vc61sIVygOsrklz1XpxqczOM
MD5:	C423AFC03840D60BAA3FD9F2AAA27BDC
SHA1:	11E2A7B46EEA101F92B01980A2F2A3F83365945D
SHA-256:	7769AA32631A77362412594D7CBDAAA60FBFF8A8046827FCB170C58563313151
SHA-512:	B7FF615E7AB3781D57F6DA2FA9CA95EBB828E32F8AB477F70510C8059CA605441FF4C1758631072615343FADA97D7FBBB91C6CB05D5FAEC933D469021ABBAEA8
Malicious:	false
Preview:	.......2. ...qt314/b0......qt314/al......b0.java...a...()V...java/lang/Exception......qt314/aV......qt314/cq......()Ljava/util/Map;.............<init>...(Ljava/util/Map;)V.............qt314/cd......(Lqt314/u;)V.......................<clinit>...Code...Exceptions...SourceFile.!...................................Y..............................................*.............................................

C:\jar\qt314\b1.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	293
Entropy (8bit):	4.4313874224737075
Encrypted:	false
SSDEEP:	6:Almd6E0KaqzsW4GzydGLw04T2rzsa1vy9vloJl5tvsluUDN:AByYGDLt46rzh14vlor4PN
MD5:	35CA3E9B843E2272D5FA96B48EABACB8
SHA1:	C14D63FE4E1C4E957E3CD8F381E7B1F6DE0610BE
SHA-256:	9629719C50F4375F602D1ACF2AB2AD50FD29C44A318E3588D10B5DF0D3463E9C
SHA-512:	9B39B6EA66A6FD1303CC6BE1E4D17BCFB2F5C571DDC975653B86F9DAA6778C3F9716FB61C3FA4B96AB8326EF5CB7A1A170FF10F441557CF363E154D01C905264
Malicious:	false
Preview:	.......2.....qt314/b1......qt314/al......b1.java...<clinit>...()V...<init>.............a...java/lang/Exception......qt314/m......d.............Code...Exceptions...SourceFile.!...........................................................*..........................................................

C:\jar\qt314\b2.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.4593660184046895
Encrypted:	false
SSDEEP:	12:is+6vtWlYTTX+NvkCLe4vNlFN9phdQ9OLsOnLt46Ht8yrU3o17GO5lo1g:ij61iY3ckAfNlFNNLPLZ8yroO7X
MD5:	F71BCED445F1F3098D0A42DA4385CB84
SHA1:	AA02A42A72570967EF3A0D15C9DD15012C2B5675
SHA-256:	C35182319198AEF767EB7D4349B04906BE5C7A6CDDE7F1B486A941878B944E35
SHA-512:	E4A212FF74A4880035150A413422F2BB037D3C674298C822402EF2C358BC071AC6B76A744FB190525B1C25FA2299C3A94006CD4E6D7909DD2C77BBF85BEA5AD6
Malicious:	false
Preview:	.......2.<...qt314/b2......qt314/al......b2.java...a...()V...java/lang/Exception......qt314/cd......e...()I.............javax/sound/sampled/AudioFormat....F......<init>...(FIIZZ)V.............javax/sound/sampled/AudioSystem......getSourceDataLine..G(Ljavax/sound/sampled/AudioFormat;)Ljavax/sound/sampled/SourceDataLine;............"javax/sound/sampled/SourceDataLine......open..%(Ljavax/sound/sampled/AudioFormat;I)V.... ....!...start..#......$...qt314/dw..&...values...()[Lqt314/dw;..(.)..'....play..2(Ljavax/sound/sampled/SourceDataLine;Lqt314/dw;I)V..,.-..'.....drain..0......1...close..3......4...<clinit>.........7...Code...Exceptions...SourceFile.!...................9...Y.......M...<...=...Y..........N-...:...-.@..."......%......+.2....h../....2......5........:...........6.....9..........................9..............8........;......

C:\jar\qt314\b3.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4900
Entropy (8bit):	5.945728821146259
Encrypted:	false
SSDEEP:	96:e85EXetD4eSOzk2UbNrl1RFIvr8z2R/QxmXsJ:eLmDIOzk9rl1Ry8z2dmmXsJ
MD5:	F1A52BF744BD128F33938F7419C32F13
SHA1:	988443DE21C76519505D8EC25EA4632D80B98E69
SHA-256:	000694BB435CAA70952F19A4DEAB5120459B60EDF71044AE01FA6D7E14C45299
SHA-512:	1CDCE98B14A6EC1D5E5CE4FE33E9ACAAAEE0BECE9F33815F870FC32DD682F61099F1DA61E8056D8999466957EA2DB92A6DC81C90F43B64A00501427EF86622AA
Malicious:	false
Preview:	.......2.....qt314/b3......qt314/al......b3.java...lllIIIlIll...[Ljava/lang/String;...z...lIIlIIIlIlII...(Ljava/lang/Object;)Z...lIIlIIIIIlIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............java/lang/String......getBytes...(Ljava/nio/charset/Charset;)[B..!.".. .#...digest...([B)[B..%.&....'...Blowfish..)...<init>...([BLjava/lang/String;)V..+.,....-...javax/crypto/Cipher../..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....1..0.2...init...(ILjava/security/Key;)V..4.5..0.6...java/util/Base64..8...getDecoder...()Ljava/util/Base64$Decoder;..:.;..9.<...java/util/Base64$Decoder..>...decode..@.&..?.A...doFinal..C.&..0.D...([BLjava/nio/charset/Charset;)V..+.F.. .G...printStackTrace...()V..I.J....K...e...Ljava/lang/Exceptio

C:\jar\qt314\b4.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2742
Entropy (8bit):	5.71914207185486
Encrypted:	false
SSDEEP:	48:aSSrZpX9yhryEIe5HEgOm2H/HljtHoYZXusJeM+x4nUJB21WG:58Z9kGEIedEomlyY4sJenxGU3gJ
MD5:	3A4138840FC1A6670C9BDE84164EAC7C
SHA1:	D763EDE6BC1A45F1D91E7E1C2E0D0034DA1B3B35
SHA-256:	C32EFC12276A22AF15856D78B24A6602A6A19F1CD4A5DF3DE3A83B03B002E48E
SHA-512:	567AC75A5CF0EFCFBC5DA006782C851DA66EFFFCF2A08B86AF9980E69546087873B70214AF7295D1F93B44F4D7121F03350A558F89A6C891C769B6AD836C23DD
Malicious:	false
Preview:	.......2.....qt314/b4......qt314/al......b4.java...z...Ljava/lang/String;...lllIIllIII...[Ljava/lang/String;...<clinit>...()V...lIIlIIlllIII.............................java/lang/String......length...()I....................... ......toCharArray...()[C............. ..!... ..#...lIIlIIlllIll...(II)Z..%.&....'...<init>...([C)V..).*....+...intern...()Ljava/lang/String;..-....../...[C..1...lIIlIIlllIlI...(I)Z..)......5...a...java/lang/Exception..8...java/io/File..:...(Ljava/lang/String;)V..).<..;.=...exists...()Z..?.@..;.A..3.4....C...delete..E.@..;.F...6ry3n997dPM=..H...OAMpf..J...lIIlIIllIlll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;..L.M....N...javax/crypto/spec/SecretKeySpec..P...MD5..R...java/security/MessageDigest..T...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..V.W..U.X..!java/nio/charset/StandardCharsets..Z...UTF_8...Ljava/nio/charset/Charset;..\.]..[.^...getBytes...(Ljava/nio/charset/Charset;)[B..`.a....b...digest...([B)[B..d.e..U.f...java/u

C:\jar\qt314\b5.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	5377
Entropy (8bit):	5.85629998938547
Encrypted:	false
SSDEEP:	96:EPtdblrEmetjjtnqO8ba22uUSRlxRv22knBAcYST8F/XOe/:EPtlAtnDx6lxRv2HB/bTk+e/
MD5:	5E341B7E811A300AC88EB9D6D0E313AE
SHA1:	48D55986999EEC126EC312E645018F4E37264F04
SHA-256:	C41FACCA2C442ADF6699A568C9E3836B9668443BF67210C7347E699581033C7F
SHA-512:	55D37564BB9C55F60B83C57474973050E6DF1C02C8AA7C0EDCC384BBB93067DA6799A8AE122E4B6A08238E71ADB5066061E954C9D9EA5B2E592509D381ECA662
Malicious:	false
Preview:	.......2.(...qt314/b5......qt314/al......b5.java...lIlllIlIll...[Ljava/lang/String;...z...<clinit>...()V...llIlllllllI.............java/lang/String......................length...()I............. ...... ...... ................toCharArray...()[C.. .!...."...lllIIIIIIlI...(II)Z..$.%....&...<init>...([C)V..(.)....*...intern...()Ljava/lang/String;..,.-...........[C..1...llIllllllIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception..5...javax/crypto/spec/SecretKeySpec..7...MD5..9...java/security/MessageDigest..;...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..=.>..<.?..!java/nio/charset/StandardCharsets..A...UTF_8...Ljava/nio/charset/Charset;..C.D..B.E...getBytes...(Ljava/nio/charset/Charset;)[B..G.H....I...digest...([B)[B..K.L..<.M...java/util/Arrays..O...copyOf...([BI)[B..Q.R..P.S...DES..U...([BLjava/lang/String;)V..(.W..8.X...javax/crypto/Cipher..Z..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..=.\..[.]...init...(ILjava/security/Key;)V.._

C:\jar\qt314\b6.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	303
Entropy (8bit):	4.527198513822752
Encrypted:	false
SSDEEP:	6:AlmdBA0AqzssdPXgh1w04T2rzsa1vj2tvsln886Gvlo6:AQBPXk1t46rzh1yCrvlo6
MD5:	DAC75698574D6217FBEF6BA7704E2AAA
SHA1:	53416B375B5F7E4B370AF17869C903B81F68840E
SHA-256:	EFFB53CC8A9947D555E2159A4644ABC0558F96BC5604E8281062E71520506C04
SHA-512:	21EDD29438BC6EB289C25589108790C42E72605ABED22FBE33C4A103D714FDA9442049A6C6E1330BA2A594C1A27D072F9BD69CE222A06F0A42AB2B42AFC16011
Malicious:	false
Preview:	.......2.....qt314/b6......qt314/al......b6.java...<clinit>...()V...a...java/lang/Exception......java/lang/System......gc.............<init>.............Code...Exceptions...SourceFile.!...................................................................................................*..................

C:\jar\qt314\b7.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	5267
Entropy (8bit):	5.867470934944091
Encrypted:	false
SSDEEP:	96:qIeYWcEaehSxbZI5P/Si+IniEQlLaciZlOLPbzQ1XlgXR5B:qIeYWQr2qNInIlOZlePbzQ11gh5B
MD5:	AAC691E9F004E354798A59379D96B746
SHA1:	5EA99AFFE8D38D7E0E886932E480AC6802FE2F6E
SHA-256:	0036C655F3181C57EC22783E309ACA016FBBABC7FB090B09538DEA9D7367E842
SHA-512:	ABF28915ADBA5BF2F42027934651813E9C5132B158C971B4D70A6235C36D0E8BE7CFE752ACC454B065B3B72FDD6C7348BFF722434FEEDD887AB6C554E84B2878
Malicious:	false
Preview:	.......2.....qt314/b7......qt314/al......b7.java...lllIlllIlI...[Ljava/lang/String;...z...lIIllIllllll...(II)Z...<init>...()V.............<clinit>...lIIllIllIlII.............java/lang/String......................length...()I............. ...... ...... ..!.........#...toCharArray...()[C..%.&....'...lIIllIllllIl..)......*...([C)V....,....-...intern...()Ljava/lang/String;../.0....1......[C..4...lIIllIllIIlI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception..8...javax/crypto/spec/SecretKeySpec..:...MD5..<...java/security/MessageDigest..>...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..@.A..?.B..!java/nio/charset/StandardCharsets..D...UTF_8...Ljava/nio/charset/Charset;..F.G..E.H...getBytes...(Ljava/nio/charset/Charset;)[B..J.K....L...digest...([B)[B..N.O..?.P...java/util/Arrays..R...copyOf...([BI)[B..T.U..S.V...DES..X...([BLjava/lang/String;)V....Z..;.[...javax/crypto/Cipher..]..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..@._..^.`...init.

C:\jar\qt314\b8.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2899
Entropy (8bit):	5.772174186069606
Encrypted:	false
SSDEEP:	48:wC0b3dirPii7BqcBrVnpEoXeJbJgpHQ6Sl3Wv/9DDpxwLPVztTVvM:wzZirqi7FjE8e/gRQ5lGv/9xxwLtj0
MD5:	73F42C08BE089C5D4F38785F9F65940C
SHA1:	C7C786E44D59F09FA61E5FB3CD3C74A347669ED5
SHA-256:	4F9DB6A06E1052AD2C334D103F7F8989D97A4397540D311A409876B663C7DB32
SHA-512:	81BBCEE83D479182DEB76EC0E25A6DFDEF7097B344C316A3EF8499BB4A8813CB9E8F387343CBA354206790B52445015266CF74F26C1231B3B15F2AA5DB5836C4
Malicious:	false
Preview:	.......2.....qt314/b8......qt314/al......b8.java...llIlIlIIII...[Ljava/lang/String;...z...Ljava/lang/String;...lIIIIlIllIll...()V...java/lang/String................buuQrykonb0=......szZhu......lIIIIlIllIlI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............<clinit>...................length...()I............. ..!.........#... ..%...toCharArray...()[C..'.(....)... ..+...lIIIIlIlllIl...(II)Z..-....../...<init>...([C)V..1.2....3...intern...()Ljava/lang/String;..5.6....7...[C..9..1......;...a...java/lang/Exception..>...qt314/cd..@...d..B.6..A.C...java/io/File..E...(Ljava/lang/String;)V..1.G..F.H...javax/imageio/ImageIO..J...read...(Ljava/io/File;)Ljava/awt/image/BufferedImage;..L.M..K.N...java/io/ByteArrayOutputStream..P..Q.;...write..I(Ljava/awt/image/RenderedImage;Ljava/lang/String;Ljava/io/OutputStream;)Z..S.T..K.U...toByteArray...()[B..W.X..Q.Y...qt314/ae..[...java/awt/image/BufferedImage..]...getWidth.._....^.`...getHeight..b....^.c...([BII)V..1.e..\.f...(Lqt314/

C:\jar\qt314\b9.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	646
Entropy (8bit):	5.261082142614847
Encrypted:	false
SSDEEP:	12:bwpAM3Mv1YSM5HPDpkM3X/jOMaMXPDt46rzl4KQACQmXeV+loVA:km6hpR/jz7SwCQmXiamA
MD5:	29B6021C274E9260E41B73C18F5B1F04
SHA1:	5F0D599A7BE050F8CCA074AA29F3A5B614A51730
SHA-256:	1F433E5F4D363CABCB2CC69AA1D35134AF538F1CCCAD33AFEF91243B0BAB7CD5
SHA-512:	66735C37DD917DF60AFC03B68D5852781D7EF4F7F8C2DDB5DEEBC3D30C9C146596C293936287DEC8FB54814414C91E8427E1C72DE37C19EF4DB37FF387C18795
Malicious:	false
Preview:	.......2.3...qt314/b9......qt314/al......b9.java...<clinit>...()V...a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/io/File......<init>...(Ljava/lang/String;)V.............qt314/c5................qt314/cK.........."(Ljava/io/File;)Ljava/lang/String;..................java/lang/System.."...gc..$....#.%...qt314/aA..'..'(Ljava/lang/String;Ljava/lang/String;)V....)..(....(Lqt314/u;)V....,....-........Code...Exceptions...SourceFile.!...................0..........................0...K.......?...L...Y+...M...Y...N...Y...:...,.. :.-,..!:...&..(Y......+.........1.................0............../........2......

C:\jar\qt314\bA.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4174
Entropy (8bit):	5.875105852850666
Encrypted:	false
SSDEEP:	96:A/XE/aKvFlCw1m0u9d6lEw8iipAst0Vz3EXCV/T2S:A/wjLw9d6lmii6wWz0XCV/iS
MD5:	CC6336F69D7A8AA62A5B6258B04A3084
SHA1:	4F13C636345BC6A4E8D5824BEE9FA91F40141273
SHA-256:	CFE921FF41D588317F75AB415A5880480D34F1E49EE2FD19ACC59FBB07BB46B5
SHA-512:	0716FD56E4678DB940D00F1D559F02F03206E6A7AF751F691EDD99802564E6FF9C408F0554106FD8DB7DFE00A49F03E8CD5796F183299F49D823FD92DFA47AF8
Malicious:	false
Preview:	.......2.....qt314/ba......qt314/al......ba.java...llIIIIlIIl...[Ljava/lang/String;...z...Ljava/lang/String;...lllIllIIlll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/String......java/util/Base64......getDecoder...()Ljava/util/Base64$Decoder;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............getBytes...(Ljava/nio/charset/Charset;)[B.............java/util/Base64$Decoder......decode...([B)[B.. .!...."...<init>...([BLjava/nio/charset/Charset;)V..$.%....&...java/lang/StringBuilder..(...()V..$.*..).+...toCharArray...()[C..-....../...llllIIlllll...(II)Z..1.2....3...append...(C)Ljava/lang/StringBuilder;..5.6..).7.....9...length...()I..;.<....=... ..?... ..A...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..C.D....E...key...sb...Ljava/lang/StringBuilder;...i...I...obj...keyChars...[C...c...C..N...llllIIlllII..'(Ljava/lang/Object;Ljava/lang/Object;)Z...llllIIllllI...a...java/lang/Exception..V...qt314/ah..X...getOpera

C:\jar\qt314\bF.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	851
Entropy (8bit):	5.3746841813764865
Encrypted:	false
SSDEEP:	24:CmZw61R1h1aa1oSj4/1z+2HATzTCVa74sn:CmZ91h1aW/4pvHA3eU7L
MD5:	D1E53D8FFE38E0B0BB556CE2C86FF471
SHA1:	FBCAD39029521309963EF4F1F7A820FF80D76432
SHA-256:	B179DB99C0DF6B6B248461D38C3B225C6D92680EE4288C7789380825805019D9
SHA-512:	A6AF829CE9EC2402C49E36EBB5B2A738604DCAEE8D5FC8D5D3EB310F89F3C4F6F622ED6C18E657505964D0D4762F47C5A24B6A960E89D467E34F89FF844F934A
Malicious:	false
Preview:	.......2.@...qt314/bf......qt314/al......bf.java...a...()V...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/lang/Runtime......getRuntime...()Ljava/lang/Runtime;.............exec..'(Ljava/lang/String;)Ljava/lang/Process;...................java/lang/String......length...()I......... ... .."... ..$...printStackTrace..&......'...java/awt/Desktop..)...getDesktop...()Ljava/awt/Desktop;..+.,...-...java/io/File../...<init>...(Ljava/lang/String;)V..1.2..0.3...open...(Ljava/io/File;)V..5.6...7..1......9...<clinit>...Code...StackMapTable...Exceptions...SourceFile.!...................<...........N...L...+.......!X....!W.#..!.%..!t..+.M,..(.....0Y+..4..8....!W.#..!....N-..(........&...+.9.H.....=...(....&...............!....................>...........1.....<............*..:........;.....<....................?......

C:\jar\qt314\bI.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4278
Entropy (8bit):	5.826806283460785
Encrypted:	false
SSDEEP:	96:J5Mj0cwhAKRE1e1/h1jq/wqglTYQnC8pPC7XpR7Gj5Sl:Q5wSejKtglTDPCNRS4
MD5:	5FFCB8ADE9E5C7F0839478A35856C686
SHA1:	4DA737F72861AEC305D989C60E04BBB5A8A5C08A
SHA-256:	090BAAED51F6808B57901314AFA5AEF6790F3E61BDBCD8E7D59F261126A1411A
SHA-512:	C85F51BD13314D24AE8256F02E38369256E82CF2E2FB494717C9FB6EC7CC707569A6BDF1ED9D8BCC1C05F87035AE0CA325DD83FF1D8F9DCA384D7B576CD8E9F4
Malicious:	false
Preview:	.......2.....qt314/bi......qt314/al......bi.java...z...Ljava/lang/String;...lllIlIlIlI...[Ljava/lang/String;...<clinit>...()V...lIIllIIIIIII.............................java/lang/String......length...()I............. ................toCharArray...()[C............. ..!... ..#...lIIllIIIlIIl...(II)Z..%.&....'...<init>...([C)V..).*....+...intern...()Ljava/lang/String;..-....../...[C..1...lIIllIIIlIII...(I)Z...a...java/lang/Exception..6...qt314/aF..8...c...Z..:.;..9.<...qt314/cd..>...d..@....?.A...java/io/File..C...java/lang/StringBuilder..E...qt314/ca..G...()Ljava/io/File;..5.I..H.J...getAbsolutePath..L....D.M...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..O.P....Q...(Ljava/lang/String;)V..).S..F.T...separator..V....D.W...append..-(Ljava/lang/String;)Ljava/lang/StringBuilder;..Y.Z..F.[..D.T...java/io/FileInputStream..^...(Ljava/io/File;)V..).`.._.a...java/io/BufferedReader..c...java/io/InputStreamReader..e...(Ljava/io/InputStream;)V..).g..f.h...(Ljava/io/Reader;)V..).j..d.k...read

C:\jar\qt314\bJ.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1837
Entropy (8bit):	5.593514305308812
Encrypted:	false
SSDEEP:	48:ga7YpHlzYPeeEzkM7T9Bnq9twBX2yV+Yys:gxpUeD9v2Oqs
MD5:	8EB60F7A1D91B839859FDF7F79A4AA22
SHA1:	F613382AFD950E38F4B756182F8B1D3D6ADD05BA
SHA-256:	6A27D08308C76F056D0E3D0D92F6F166B9EBC927167D7FA2EDB95FF88F37CD0D
SHA-512:	58ECE26E17A45B0FA719A5CC8F63239DB3E067DD8B5F6FA67E8EC1D990BB09457A781C4DE4A0BC80A66B257DBB192EE5CCF6BC948399D500B9881043974E690A
Malicious:	false
Preview:	.......2.y...qt314/bj......qt314/al......bj.java...lIIllIIlllll...(I)Z...lIIllIlIIIII...a...()V...java/lang/Exception......qt314/aF......c...Z.............qt314/cd......d...()Ljava/lang/String;.............java/util/zip/ZipFile......<init>...(Ljava/lang/String;)V.............entries...()Ljava/util/Enumeration;.... ....!...java/util/ArrayList..#.......$.%.........'...java/util/Enumeration..)...nextElement...()Ljava/lang/Object;..+.,...-...java/util/zip/ZipEntry../...isDirectory...()Z..1.2..0.3...java/util/List..5...add...(Ljava/lang/Object;)Z..7.8..6.9.....;...java/lang/String..=...length...()I..?.@..>.A...hasMoreElements..C.2...D.........F...iterator...()Ljava/util/Iterator;..H.I..6.J...java/util/Iterator..L...next..N.,..M.O... ..Q...qt314/aI..S...getName..U....0.V...(ZLjava/lang/String;J)V....X..T.Y...(Lqt314/u;)V....[....\...hasNext..^.2..M._... ..a...getSize...()J..c.d..0.e............close..i......j...b..l......m... ..o...java/lang/Object..q....%...<clinit>...Code...StackMapTa

C:\jar\qt314\bK.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3222
Entropy (8bit):	5.7329057971861115
Encrypted:	false
SSDEEP:	48:5sMbS4O0E+8eDMZ3yn09itQs7vF3But6l3yqBT/9pQzEEFCjGnffGD:JFE+8eSyQsR38t6ltBJWtF4GGD
MD5:	A931B798007B9551BC77C9F9C8F9307E
SHA1:	10BB2DB9FBE501FBAED55FE664695C7FB37D9F57
SHA-256:	DB4B03E6FB5E72A353922AC5FA1F7B12066FC96715FC254CC81884C587888166
SHA-512:	94AB70B6644B63B51057E123754567245922C8A39B1EF128BF35C7D05D7CAD36BA7C4737B5EBB05C9B9EDDCEB4AB65AD5D03505C7DA06ABB7B799BE6F3F0FAFF
Malicious:	false
Preview:	.......2.....qt314/bk......qt314/al......bk.java...z...Ljava/lang/String;...llllIIlIII...[Ljava/lang/String;...lIIllllIllIl...()V...java/lang/String................+uBU9mX/Ke8=......yZpVY......lIIllllIllII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;.. .!...."..!java/nio/charset/StandardCharsets..$...UTF_8...Ljava/nio/charset/Charset;..&.'..%.(...getBytes...(Ljava/nio/charset/Charset;)[B..*.+....,...digest...([B)[B..../....0...Blowfish..2...<init>...([BLjava/lang/String;)V..4.5....6...javax/crypto/Cipher..8..)(Ljava/lang/String;)Ljavax/crypto/Cipher;.. .:..9.;...init...(ILjava/security/Key;)V..=.>..9.?...java/util/Base64..A...getDecoder...()Ljava/util/Base64$Decoder;..C.D..B.E...java/util/Base64$Decoder..G...decode..I./..H.J...doFinal..L./..9.M...([BLjava/nio/charset/Charset;)V..4.O....P...print

C:\jar\qt314\bL.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.2537377718035145
Encrypted:	false
SSDEEP:	24:Sll61qRgTMfYzTRc7RVGSXzu3eqErZKoDuD/cFaOx7n:q4cYz9UVjEY3QcFaOx7n
MD5:	E023CA80DAD435F6163829AEA334EC47
SHA1:	E13305CB6E84B4922614B658991102992C830EAB
SHA-256:	149D4E2E9D872EDA5A55B92A32ACE032B15A24B18D48B6503F3B22ED6F863E4B
SHA-512:	302FBF3CA913453195D464709EA15D0412070210EDB2A33F2FFC390064CC644D52B21249949B81F15B0BB7C20F1E2FE7508EC916345AB5A6DC8032B0CD68E6F6
Malicious:	false
Preview:	.......2.L...qt314/bl......qt314/al......bl.java...a...()V...java/lang/Exception......qt314/aF......c...Z.............qt314/cd......d...()Ljava/lang/String;.............java/io/File......<init>...(Ljava/lang/String;)V.............exists...()Z.............lIIlIlIIlIlI...(I)Z.. .!...."...length...()J..$.%....&...java/io/FileOutputStream..(...(Ljava/io/File;)V......).+...java/util/Random..-........./...nextBytes...([B)V..1.2....3...write..5.2..).6...lIIlIlIIlIll...(II)Z..8.9....:...lIIlIlIIllII..<.!....=...close..?....).@...java/lang/String..B...[B..D...<clinit>..../...Code...StackMapTable...Exceptions...SourceFile.!...................H...........f...6....L...Y+...M,.....#..L,..'.>..)Y,..,:......:..6....Y..0....4......7..........;.........>....A......I...4....6.......C......)..E....M..).. .......C...........J...........F.....H.................... .!...H...!.......................I.......@....8.9...H..."........................I.......@..........H..............G........<.!...H...!.....

C:\jar\qt314\bR.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.695482267903022
Encrypted:	false
SSDEEP:	6:ClmdPS0nEYszG3klk9ESIZXL1mCVXHVWSE1w04T2v3G++lozU4t2YjFl/0TL1vAn:ClmNpdSBkEtL1RHV+1t46vGvlo4o2aFL
MD5:	DFF5E3B8442BE61FFB88726492B3B2D7
SHA1:	C8C087438F3E302CC27C5F1312ACF00D5E1B390E
SHA-256:	C574099B3395D174FAF5D2E15C6EFDE02D597A8886D713D01EFA41EB41222545
SHA-512:	886F8009A7D9F3D7182D83AB9A4789890C05F25AD282C432BEE3723D4184D68E3BD18E0CCF714E074D6B483C3150E2EC586F086CF82898D01E1A12D6B06ED54F
Malicious:	false
Preview:	.......2.....qt314/br......qt314/al......br.java...<init>...()V.............a...java/lang/Exception......qt314/cd......k...Ljava/net/Socket;.............java/net/Socket......close.............<clinit>...Code...Exceptions...SourceFile.!................................*........................................................................................

C:\jar\qt314\bU.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.902016153717449
Encrypted:	false
SSDEEP:	6:Qj0GAqzssbJl6ALOWZroR2sloKURGysR/CvzLg9LkJw04T2rzGvjJ81+lslol8h:aBlbroXlkYRq8LkJt46rzGVelolQ
MD5:	90856EE1F4FC08BA1246E9B719E29413
SHA1:	75A348D682BAFB0EA52BAEA6A67AE42305750FF2
SHA-256:	6AA2763C0834BA2F31203FDBE4E940A90C2AFDEB404BD1F9965A20E9D51D4BDF
SHA-512:	923ECC580488F550930416E12B9C1C785B96F1F7AFA2ADCE2903B3865B3450FC6BAF6113296746E818EF1FDB8634AC8B30047A177274D3D5942CF37FB242164D
Malicious:	false
Preview:	.......2.#...qt314/bu......qt314/al......bu.java...<clinit>...()V...a...java/lang/Exception......qt314/cd......e...()I.............qt314/c1......b...Ljava/awt/Robot;.............java/awt/Robot......keyPress...(I)V.............<init>.............Code...Exceptions...SourceFile.!................... .......................... ...............<.............!................. ............*..........."......

C:\jar\qt314\bV.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	721
Entropy (8bit):	5.282827731815276
Encrypted:	false
SSDEEP:	12:8gXAM3Mv1mMpb7MYlwM38bSMZP/M33WMBMhg3LWnPJL1t46rzF1WKrtKzIyvloa:VwrbMbl6RoPJL1zWKQzH9r
MD5:	A31A03FCCFCB924B2541B9A5BD1297A8
SHA1:	01BE8C7FB3A651DA0D1B9BF9DFDAABAE7B1BD70F
SHA-256:	85F856B56C558539C120329FBB4A54F2961F51FC7B345E4EB160842B71EF50F8
SHA-512:	0814ECDDCF67858AD63911A2DA05E9F4CF9CE6953BF81C0A0585AF9A59144AE70009D8B2261A2D7E860E60E9B8626CC879DCBDD65474B894425F6C6280025941
Malicious:	false
Preview:	.......2.:...qt314/bv......qt314/al......bv.java...<clinit>...()V...a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/io/File......java/lang/StringBuilder......java/lang/String......valueOf..&(Ljava/lang/Object;)Ljava/lang/String;.............<init>...(Ljava/lang/String;)V.............separator...Ljava/lang/String;.... ....!...append..-(Ljava/lang/String;)Ljava/lang/StringBuilder;..#.$....%........mkdirs...()Z..(.).........,...length...()I..../....0...(I)V....2....3.........5...Code...Exceptions...SourceFile.!...................7..........................7...D.......8...L...M...Y...Y+........"..&,..&.....'N-..+.-..1X....4......8.................7..............6........9......

C:\jar\qt314\bW.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.523828907205262
Encrypted:	false
SSDEEP:	6:AlmdcE0Fso6vt0usjZXgBmwE1w04T2vyyHMuFN8/Uldvlorc/5sa1vO:APJ6vtdsjheK1t46psuPdvloARh1G
MD5:	FEDD6278D14F16C993B225A77D018221
SHA1:	46043EEAE1A23173B95A433935D78FD0985369BC
SHA-256:	EC8A35395EA1165E300F83A36597B63789BA3D9F7C984CFF09475E337F3D16E0
SHA-512:	A56E8C4DBBF76D389A115C4EEAFAD685CA96C9DAC937F778D98FC75EF0268D7296FBD3B8DE8A5512E1DBB25A1BAF5E30A5E14FFABE59CA8BBC4DAABD2A9B5B18
Malicious:	false
Preview:	.......2.....qt314/bw......qt314/al......bw.java...a...()V...java/lang/Exception......qt314/cv......<init>............................<clinit>...Code...Exceptions...SourceFile.!...................................Y...........................................*.............................................

C:\jar\qt314\bX.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2555
Entropy (8bit):	5.63764710004423
Encrypted:	false
SSDEEP:	48:tmCSiI8Og0Pk79AEPe7VH4yE3plWlMqHlJteIKLr8/++ArML:tmX/jkqEPe7R49vHslJAfLsiK
MD5:	640EB08B2DC641D09DD65A6569351675
SHA1:	A30BAAAAB93BC5120EBF45DB2F173E726902CC81
SHA-256:	F3445E669E65F30BEBF526670D31EFC584587F60E97D2E43862ED27947835C89
SHA-512:	F018AF9F00E96C0F6BC449C77FF14F83BD658F428DB63FC4B47E462E899EBF6AB5BC2E5AEE9DFE6232996DE8D42ECC274A7E7B8D4920B14788B6AB70F1E7937C
Malicious:	false
Preview:	.......2.....qt314/bx......qt314/al......bx.java...llllIIIlIl...[Ljava/lang/String;...<clinit>...()V...lIIlllIlIIIl.............lIIllllllIIl...(I)Z...a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/io/File......java/lang/String......length...()I.............substring...(II)Ljava/lang/String;.. .!...."...qt314/cz..$..&(Ljava/lang/String;)Ljava/lang/String;....&..%.'...<init>...(Ljava/lang/String;)V..).*....+...java/lang/StringBuilder..-...getAbsolutePath../......0...getName..2......3.........5...replace..D(Ljava/lang/CharSequence;Ljava/lang/CharSequence;)Ljava/lang/String;..7.8....9...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..;.<....=....+...append..-(Ljava/lang/String;)Ljava/lang/StringBuilder;..@.A....B...exists...()Z..D.E....F.........H...renameTo...(Ljava/io/File;)Z..J.K....L.....N... ..P...lIIlllIlIIII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...javax/crypto/spec/SecretKeySpec..T...MD5..V...java/security/MessageDigest..X

C:\jar\qt314\bZ.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3269
Entropy (8bit):	5.812217553039072
Encrypted:	false
SSDEEP:	96:5tCrhbPkEbLECPUwjl0heE+QgFR3e8Por9G:5tShj/Rpjl7E+QgeI
MD5:	AEF63D4C646CFE975D6A14E156ECA439
SHA1:	F0A9C2ACAEA0B2721DF61F0D8759169ADC9F8CF2
SHA-256:	5BA3068D9D9DC060C80213E77200005EF1DE9ED32D723700C8D25CA769D045C6
SHA-512:	5227EABFE60038FFCDA1764EF61795DBAF0EA632B422277BC0781B306856A3B7CE004BE2887C19BD8FF1A08E367380C60EF0FDDC257E5ADACB4621C8538D7FD2
Malicious:	false
Preview:	.......2.....qt314/bz......qt314/al......bz.java...lllIIllIll...[Ljava/lang/String;...z...Ljava/lang/String;...lIIlIlIIIlll...(II)Z...<init>...()V.............lIIlIlIIIlII...(I)Z...lIIlIlIIIIll..'(Ljava/lang/Object;Ljava/lang/Object;)Z...a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............qt314/ah......getOperatingSystem...()Lqt314/ah;.... ....!...WINDOWS...Lqt314/ah;..#.$....%.........'...qt314/i..)...(Lqt314/bz;Ljava/lang/String;)V....+...,...start......../...qt314/aF..1...c...Z..3.4..2.5.........7.....9...java/lang/String..;...length...()I..=.>..<.?... ..A...OSX..C.$....D...java/lang/Runtime..F...getRuntime...()Ljava/lang/Runtime;..H.I..G.J...java/lang/StringBuilder..L.........N...(Ljava/lang/String;)V....P..M.Q...append..-(Ljava/lang/String;)Ljava/lang/StringBuilder;..S.T..M.U...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..W.X..<.Y...exec..'(Ljava/lang/String;)Ljava/lang/Process;..[.\..G.]... .._...printStackTrace..a......b...lIIlIIllllll..8(Lja

C:\jar\qt314\b_.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3944
Entropy (8bit):	5.829404895369773
Encrypted:	false
SSDEEP:	96:D8EMbWvbpX22v1xrlJPDQ96/YLbDr4GaNFo4nx/8SdDh:sWvbpGmpluTbv7aNFo4nx/84N
MD5:	FB390005626B132B17C158D97B603891
SHA1:	FECBA552AAD2B52A23E4EDECDACB112ADAC57EC0
SHA-256:	6B77B08B3A0504C22CF73620C6CF2CC471B3801DB9749FD17920256C159B6ADC
SHA-512:	4A396F9E69C646E53EF9F38C2315A1E2BEB73670F6E7FB964B7D2F280551F692119FCFDC6EF21DA991D58702723E19D7AB83F7E12C2CD0E93CE323848F97D776
Malicious:	false
Preview:	.......2.....qt314/b_......qt314/al......b_.java...z...[Ljava/lang/String;...llIllIIlIl...lIIIlIlIIIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/String......java/util/Base64......getDecoder...()Ljava/util/Base64$Decoder;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............getBytes...(Ljava/nio/charset/Charset;)[B.............java/util/Base64$Decoder......decode...([B)[B.... ....!...<init>...([BLjava/nio/charset/Charset;)V..#.$....%...java/lang/StringBuilder..'...()V..#.)..(....toCharArray...()[C..,.-........lIIIlIlIIlII...(II)Z..0.1....2...append...(C)Ljava/lang/StringBuilder;..4.5..(.6.....8...length...()I..:.;....<... ..>...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..@.A....B...c...C...sb...Ljava/lang/StringBuilder;...key...Ljava/lang/String;...obj...i...I...keyChars...[C..N.......a...java/lang/Exception..R...java/io/FileInputStream..T.........V...(Ljava/lang/String;)V..#.X..U.Y...qt314/ca..[..)(Ljava/

C:\jar\qt314\bb.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.007298645511491
Encrypted:	false
SSDEEP:	12:45dSBkYlJrEbHQDYjS7MknPZIhDzka4Clo4lIwXelt0/1/18PlT:e4r+mfvPZQDzfBlISePKX8h
MD5:	097973AB1FF2D9FB3E8D4E0C2C7861FE
SHA1:	AEA9B17AAB4EF5322A2418F6569767C0E1477FE3
SHA-256:	BFCA269FF780956B9263750CE531FAA423A14A45AB7F6F9EA1BF9E4308DD7B62
SHA-512:	63F23C7D3FFB42520D44048D34A86D3C4A369365F2FC3934D383B64D1990886047A17F703B6CF05A8C9E369DAA0AED61A4DA8211192FE0DE9D62673A95517239
Malicious:	false
Preview:	.......2.+...qt314/bB......qt314/al......bB.java...<init>...()V.............lIIlIllllIlI...(Ljava/lang/Object;)Z...<clinit>...a...java/lang/Exception......qt314/cd......Lqt314/dE;.......................qt314/dE......................java/lang/String......length...()I.... ....!... ..#... ..%...Code...StackMapTable...Exceptions...SourceFile.!...................'.............................'...!......................(.......@..........'..........................'...G.......&..................."W.$..".&.."t.............$.....(......d.....)...........*......

C:\jar\qt314\bc.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	7770
Entropy (8bit):	5.970519690524015
Encrypted:	false
SSDEEP:	96:enayEy2njKHlmHp6P+P0m9VQDAfml2XCSCKTxgFeNM3j/uyZIWF+IEBAxNv:encjClmQmM1NliLyEu3j/uy17QK
MD5:	7C93328DEC59890E6C474AAA6F5FBB15
SHA1:	D445D391CD4840BD6C15F054C73C86F3E1F6C148
SHA-256:	5E03C13736AC10685AA97EA88DACC6B135F800B2140790C2AF32623C5B0A6395
SHA-512:	673160C19F1461ED60DDAAD4DD6C3C1783E130215D83C642AB7B7E453DB5F4D7CBEBEB53CA0BDB80141A8256A5C0FE1F1703B3166C1E936CF773683F2E9AA955
Malicious:	false
Preview:	.......2.v...qt314/bC......qt314/al......bC.java...lllIlllllI...[Ljava/lang/String;...z...lIIllllIIIll...(I)Z...lIIlllIIIIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/String......java/util/Base64......getDecoder...()Ljava/util/Base64$Decoder;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............getBytes...(Ljava/nio/charset/Charset;)[B.............java/util/Base64$Decoder......decode...([B)[B..!.".. .#...<init>...([BLjava/nio/charset/Charset;)V..%.&....'...java/lang/StringBuilder..)...()V..%.+...,...toCharArray...()[C..../....0...lIIllllIlIII...(II)Z..2.3....4...append...(C)Ljava/lang/StringBuilder;..6.7...8.....:...length...()I..<.=....>... ..@...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..B.C....D...key...Ljava/lang/String;...obj...c...C...keyChars...[C...i...I...sb...Ljava/lang/StringBuilder;..L...lIIllllIIIlI....,...lIIllllIIIIl..'(Ljava/lang/Object;Ljava/lang/Object;)Z...lIIllllIIlll...<clinit>...lI

C:\jar\qt314\bd.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	5014
Entropy (8bit):	5.917019172924558
Encrypted:	false
SSDEEP:	96:6RZBGdHEX7tJR+GMM2TTcc+l+bx0ImEGI5laanF7syhJR2kag7stviR+5pHYlnH1:6ztJgIFC0I8I5lPnSyhJRbag7stviR+Y
MD5:	E9F51A7832372B2BB4CE7B7DCAE930B6
SHA1:	410219611DBEF59E4BA2FDBB92EAE320D5105D28
SHA-256:	B9B42193341408CC62822DDD0D6AD0922AD4A7E796A6B1819030111A14626C1A
SHA-512:	EDAD2DA50117E2E4BF92CA6A2F977F871C9FBEEC322576B9CEB80CF70CF61F3F8016C3D0E58981D9B00D622A005F30739A6DDFFB7B6561038596870887735C51
Malicious:	false
Preview:	.......2.....qt314/bD......qt314/al......bD.java...lllIlIllll...[Ljava/lang/String;...z...lIlIIIIIIIlI...(II)Z...lIlIIIIIIIII...(Ljava/lang/Object;)Z...lIlIIIIIIIIl...<init>...()V.............lIIllIIIllIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/String......java/util/Base64......getDecoder...()Ljava/util/Base64$Decoder;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;......... ...getBytes...(Ljava/nio/charset/Charset;)[B..".#....$...java/util/Base64$Decoder..&...decode...([B)[B..(.)..'.*...([BLjava/nio/charset/Charset;)V....,....-...java/lang/StringBuilder../..0.....toCharArray...()[C..2.3....4.........6...append...(C)Ljava/lang/StringBuilder;..8.9..0.:.....<...length...()I..>.?....@... ..B... ..D...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..F.G....H...c...C...key...Ljava/lang/String;...sb...Ljava/lang/StringBuilder;...i...I...obj...keyChars...[C..T...lIIllllllllI..'(Ljava/lang/Object;Ljava/lang/Object;)Z...lIIl

C:\jar\qt314\be.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	330
Entropy (8bit):	4.6696503729391905
Encrypted:	false
SSDEEP:	6:HST02BszG3klSXXdOJq62w04T2vplFlozUKl/lXvDllMuhaIDt6n:ISBSvt46xvlo4Kl/1LlqukIDt6
MD5:	B7C9DC5F6A9436BA1594077179C8C242
SHA1:	0D033CDF885DB09E32317AF097ECEC54A22AFC11
SHA-256:	4C735AD87B439846B52E531CE8D9260DBFA78E45054898C91243EF856A10A25A
SHA-512:	E90B4B7C08C1D7AD808AD85DE17E6477FFCF1A9227459CE31B7E78BF58E26B76A441514E2A1CE091678336D7997C6DA70FA4D69B2C31490E4FD1A3D4EC3884FB
Malicious:	false
Preview:	.......2.....qt314/bE......qt314/al......bE.java...<init>...()V.............<clinit>...a...java/lang/Exception......qt314/J...........qt314/cd......(Lqt314/u;)V.............Code...Exceptions...SourceFile.!................................*............................................................Y...............................

C:\jar\qt314\bg.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	901
Entropy (8bit):	5.300417386717855
Encrypted:	false
SSDEEP:	24:Cmy61Qv3S811PsN1Bj8w9v98KA1zhau6jTVa74RQPn:Cm6v3xvsN3FcS3U7cQP
MD5:	FDC5C8EBEAC47465B5FC103B78E0049B
SHA1:	A9DB5AF1489FB54E1B3447D2D3B59B913E3F4136
SHA-256:	C88DBE46CE61A963F61CEE389EBAFCA2CEE89F68F2C7545EF99C00DC40DFEBAB
SHA-512:	E0D3BE443FFDC321C4D0CA86F5797C8E67A4CF31F2219A8D01B7A2BBDF73A339985C30C7CD4ECAAC9E795EFC4F063637283C7F1C8219D264C13A5FBDF8201E02
Malicious:	false
Preview:	.......2.@...qt314/bG......qt314/al......bG.java...a...()V...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............java/io/File......separator...Ljava/lang/String;.............java/lang/String......endsWith...(Ljava/lang/String;)Z.............lllIllIIlIl...(I)Z.............java/lang/StringBuilder.. ...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..".#....$...<init>...(Ljava/lang/String;)V..&.'..!.(...append..-(Ljava/lang/String;)Ljava/lang/StringBuilder;...+..!.,...()Z........./...qt314/dO..1..((Ljava/lang/String;Ljava/lang/String;Z)V..&.3..2.4...start..6....2.7..&......9...<clinit>...Code...StackMapTable...Exceptions...SourceFile.!...................<...V.......<...L+..............!Y+..%..).....-..%L...M..0>..2Y+,...5..8......=........&....>...........&.....<..............:........;.....<..........................<...!.......................=.......@....?......

C:\jar\qt314\bh.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3442
Entropy (8bit):	5.784539190712445
Encrypted:	false
SSDEEP:	96:x/BzPEFNV7pcgkdubwAV4lSZhN9c6bce7ukCkTCsEpL:NGPRn4lSDBCkTCsEF
MD5:	B726CDD6EDEB9E3C4FDD552DC14D704C
SHA1:	AE27D65D77F620F1E026AA0DD50954A7DFB6FA68
SHA-256:	D0508F2E0F484ECDF2C007BD156E624731FCD21F59E79826E226B74AF7076ED1
SHA-512:	E2A20765D5C72B66E5783550E5318930ED0640EF598B8D1D58CC6556C77E4A24F6534A8B41D851E1D2CD6DE4FC8746899944524D2DFF90C741B1A48F2E3FE2CD
Malicious:	false
Preview:	.......2.....qt314/bH......qt314/al......bH.java...z...Ljava/lang/String;...llIIlIIIII...[Ljava/lang/String;...lIIIIIIIlllI...(II)Z...llllIlIIlll...()V...java/lang/String................Yg==......hINPi......llllIlIIllI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............VEoLMxN4SQkiEy0F......MuAMK......java/util/Base64......getDecoder...()Ljava/util/Base64$Decoder;.. .!...."..!java/nio/charset/StandardCharsets..$...UTF_8...Ljava/nio/charset/Charset;..&.'..%.(...getBytes...(Ljava/nio/charset/Charset;)[B..*.+....,...java/util/Base64$Decoder......decode...([B)[B..0.1../.2...<init>...([BLjava/nio/charset/Charset;)V..4.5....6...java/lang/StringBuilder..8..4....9.:...toCharArray...()[C..<.=....>...lIIIIIIIllll..@......A...append...(C)Ljava/lang/StringBuilder;..C.D..9.E.....G...length...()I..I.J....K...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..M.N....O...c...C...obj...key...keyChars...[C...i...I...sb...Ljava/lang/StringBuilder;..V....:...lIIIIIIIllIl...(Ljava/lang/O

C:\jar\qt314\bm.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.6878795990607465
Encrypted:	false
SSDEEP:	6:HSGE0RqzsW4GzymyEJq62w04T2rz0lXvyolFloJlrllMuhaIDt6n:leYGkt46rz01NvlorrlqukIDt6
MD5:	56661379CE35D83107EC8BC284AB9F5E
SHA1:	AA383F4F8567C142C8207EA41093122520C6267F
SHA-256:	AF39DBB737E794239A27ECEF68493B00323E8A5349B91E3E0B9584B01778ED1B
SHA-512:	A31F23CCE001190D671FA42A7898C9D53A341D5271E0CFA121465BE24E99710C92E9571E0921C0539B350F0B497DDB8CB21E80BE9F3B7878211B443D3F0B30AD
Malicious:	false
Preview:	.......2.....qt314/bM......qt314/al......bM.java...<clinit>...()V...<init>.............a...java/lang/Exception......qt314/aO...........qt314/cd......(Lqt314/u;)V.............Code...Exceptions...SourceFile.!...........................................................*.................................Y...............................

C:\jar\qt314\bn.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.8028943213998545
Encrypted:	false
SSDEEP:	6:1SjS0rErqzsW4GzymgEDldNEdSitw04T2rzelXvyClFloJlLlzlRbETl/2Mr6:gdpYG1ljct46rzelXnlFlorRnEpLu
MD5:	2D111F9990AB3F6337FB3639E243198F
SHA1:	A981482E37E39BD64699686690F2F0FBAA075CE4
SHA-256:	5E34718876801AE725D07221FB1394E4D5B646DA9E276B58200100EC256228CC
SHA-512:	86650E67A508F7809AAF5A29640D223D73C75DF98AAEB0715E2696EA017377A6703EDAAF5BF6667BDEE2849B803F80FC5580F7797D2A7CF3BE4AC0564C234A15
Malicious:	false
Preview:	.......2.....qt314/bN......qt314/al......bN.java...<clinit>...()V...<init>.............a...java/lang/Exception......qt314/cd......e...()I.............qt314/d1......(Lqt314/bN;I)V.............start.............Code...Exceptions...SourceFile.!............................................................................................<...Y................................

C:\jar\qt314\bo.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2903
Entropy (8bit):	5.803951317063882
Encrypted:	false
SSDEEP:	48:k8SnJS2ykSI827VH5EOeBHX5djnv4X71hVdDIlTflVVRBt0nFK6VPFQnH+rjLI6:DYZRH7p5EOelXXJlTrQnFdWnH+TI6
MD5:	C1B11C905E3AA1D6E759D4D17BD193A6
SHA1:	5A4FD55146BF0CC65559A74C63781ED726301422
SHA-256:	01A98B31FF692D40ADED9A835EB5DB32FB762747A5A5CFDD948E32A3EF516740
SHA-512:	940E639EEE6D1BA39344C3CBAA0CED5CA520E207884AB21A1A9BA069F8BBDA08619D6ED2A49E605DF35F2E1C684DB173BED15B58CAFA31654DC2280A4562DE93
Malicious:	false
Preview:	.......2.....qt314/bO......qt314/al......bO.java...z...Ljava/lang/String;...llIllIlIlI...[Ljava/lang/String;...<init>...()V.............lIIIlIlIlllI..'(Ljava/lang/Object;Ljava/lang/Object;)Z...lIIIlIllIIII...(II)Z...<clinit>...lIIIlIlIlIlI.............................java/lang/String......length...()I............. .. ........."... ..$... ..&...toCharArray...()[C..(.)....*.........,...([C)V........./...intern...()Ljava/lang/String;..1.2....3...[C..5...lIIIlIlIlIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception..9...javax/crypto/spec/SecretKeySpec..;...MD5..=...java/security/MessageDigest..?...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..A.B..@.C..!java/nio/charset/StandardCharsets..E...UTF_8...Ljava/nio/charset/Charset;..G.H..F.I...getBytes...(Ljava/nio/charset/Charset;)[B..K.L....M...digest...([B)[B..O.P..@.Q...java/util/Arrays..S...copyOf...([BI)[B..U.V..T.W...DES..Y...([BLjava/lang/String;)V....[..<.\...javax/crypto/Cipher..^..

C:\jar\qt314\bp.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	310
Entropy (8bit):	4.571081175280832
Encrypted:	false
SSDEEP:	6:MnE0vaqzsW4GzymG6oaEw04T2rzCvySloJlJMuh7ltVD2:GDXYGYt46rzC3lorOuDXD2
MD5:	692CBC42D37FF642788FEB95B8E2BC64
SHA1:	F2775B73546015ECBCB0F82E7219D59DDB24403B
SHA-256:	D121E4FEF0DA81BC0D8A7857FD6EB823AABE8AFECADFF0D30FCA7BED7A8DFD5D
SHA-512:	700D94C57C4C02BAEF86618C6D0B0C37B70A20D6EAB01FE93629836DA06070DDEC5BE949EE83642E47EE9D4019DCC7D75153977E746294321E513F3B9C613A3F
Malicious:	false
Preview:	.......2.....qt314/bP......qt314/al......bP.java...<clinit>...()V...<init>.............a...java/lang/Exception......qt314/dA...........start.............Code...Exceptions...SourceFile.!...........................................................*.................................Y...............................

C:\jar\qt314\bq.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	361
Entropy (8bit):	4.771896293119963
Encrypted:	false
SSDEEP:	6:0EX06Oso6v183+akD1Ys+U1llNfklSXE1w04T2vIZWfOlov8/0lqvNgn:C6v183wSM17NkSU1t46ffOloE0lqan
MD5:	5EAFDEBF8BE118B7DC8224E4ED0C8FCF
SHA1:	8C775CEAEB7A739362685EDD9EAF155CA3CAAA5A
SHA-256:	3B9D04B0AC1123D42669AED8A1D670BFA89C8802782D7EF7077F0B7BD5852052
SHA-512:	C271F7E47E6C73186A8C30B263A7D44D8C7310A894D9C6731FD815C3F54C74774ACC347CEF675D5FCA70E2472F67B788396F0D08A20CF6B11D98A6559311DF51
Malicious:	false
Preview:	.......2.....qt314/bQ......qt314/al......bQ.java...a...()V...java/lang/Exception......java/awt/Toolkit......getDefaultToolkit...()Ljava/awt/Toolkit;.............beep.............<init>.............<clinit>...Code...Exceptions...SourceFile.!...........................................................................*.............................................

C:\jar\qt314\bs.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.472673138061052
Encrypted:	false
SSDEEP:	24:QSaQzbPTH8REf5MIVXhkhMziG9BlD4+ZYyIWOMk:Qyj8ifdhZiG9B1489OMk
MD5:	BEE196F8C00E042ADC71F95AE33B5F14
SHA1:	94546E6370D249A7ED1957A01AC86CBB12314F29
SHA-256:	E97112C62736A22AACB29D85B4B614257477BEA41CBACC0CD80ABBB7EF7BD57A
SHA-512:	7E2DD91D31BAF8AEB6EE00891E70B7144226DD42167922D58CE238217A5F5724A6E61F017572FB9C20E389DBE6D103513FB1DC1081BF605E954AC806A7FFCB31
Malicious:	false
Preview:	.......2.M...qt314/bS......qt314/al......bS.java...<init>...()V.............<clinit>...a...java/lang/Exception......qt314/cd......d...()Ljava/lang/String;.............e...()I.............java/lang/String......length.............substring...(II)Ljava/lang/String;.............qt314/cz..!..&(Ljava/lang/String;)Ljava/lang/String;....#..".$...java/net/URL..&...(Ljava/lang/String;)V....(..'.)...javax/sound/sampled/AudioSystem..+...getAudioInputStream..6(Ljava/net/URL;)Ljavax/sound/sampled/AudioInputStream;..-....,./...getClip...()Ljavax/sound/sampled/Clip;..1.2..,.3...javax/sound/sampled/Clip..5...open..)(Ljavax/sound/sampled/AudioInputStream;)V..7.8..6.9...lIIlIIlIllll...(I)Z..;.<....=.....?... ..A...loop...(I)V..C.D..6.E..$javax/sound/sampled/AudioInputStream..G...Code...StackMapTable...Exceptions...SourceFile.!...................I.............................I..........................I...........Z...L...=+.+..... ..%L..'Y+..N-..0:...4:.......:.......>.....@...W.B....B..........d..F....

C:\jar\qt314\bt.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	366
Entropy (8bit):	4.799122198414896
Encrypted:	false
SSDEEP:	6:uhS01Elso6vt0CaZXgvKbP1tcccMvcHHyWDw04T2vyl/WbcUll/wi+ovfs+loj8f:uEt6vtkVgyWDt46O/H8l4zons+loy
MD5:	21C9E45C1655DCCAE7A1E63D5352EB80
SHA1:	8A6384B50F6C5953629A57221D562103534B2F6F
SHA-256:	8F96EBFFCA702E56F200B10DA568BD051CF1046BD455FECF040D70D0ED385667
SHA-512:	E5C286A23B1ADC047C4188CE1CCA44A59C4175E1FC80E34043C6A8224E9F89AC4BD0910B74464E9D67BEF2ECDF02052E516060AF023C7F9331FD4BCDD3D65AD4
Malicious:	false
Preview:	.......2.....qt314/bT......qt314/al......bT.java...a...()V...java/lang/Exception......qt314/dE......<init>.............qt314/cd......Lqt314/dE;.............setVisible...(Z)V.............<clinit>........Code...Exceptions...SourceFile.!...................................Y.............................................................................*..................

C:\jar\qt314\by.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	875
Entropy (8bit):	5.292154310200639
Encrypted:	false
SSDEEP:	24:N61iEooq75pO8HhhPUzKjlFi/jY4+NaKG9e0+Dl4:VEnqdg8HhF8cFaKG9Ql4
MD5:	6283F40F0370E35586D9EF32339BA5ED
SHA1:	351C5C361D1D4F189B7AE25818CAE3929DF41C58
SHA-256:	830CC3BF1A214F99B6E657E2B68C3C3884AB98659FBD51DFC98ECF90F39EBC2F
SHA-512:	F9070587AA06C2FB213C6A793B8E6E90E24A08CDA7F26822158D2349752EDF9B1D2B59CD9A35B4ED32C393A1516345118C32EE81141A30ADE7116261E749A62A
Malicious:	false
Preview:	.......2.A...qt314/bY......qt314/al......bY.java...a...()V...java/lang/Exception......qt314/cd......e...()I.............llllIllIIIl...(II)Z.............qt314/c1......b...Ljava/awt/Robot;.............java/awt/Robot......mouseMove...(II)V.............mousePress...(I)V.. .!...."...qt314/aF..$...c...Z..&.'..%.(...llllIllIIlI...(I)Z...+....,.........java/lang/String..0...length..2....1.3...d...[Ljava/awt/Robot;..5.6....7...<clinit>...<init>..:......;...Code...StackMapTable...Exceptions...SourceFile.!...................=...........v...<...=...>...6.........2..............#..)..-..F./..4W.`.~..W.L..t.......8..2.......8..2...#./..4W.+...x.P...~...........^.t.....2.H.....>........H...............j.....?...........9.....=..........................=..."........................>.......@....:.....=..............<........*.+...=...!.......................>.......@....@......

C:\jar\qt314\c0.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	5138
Entropy (8bit):	5.9316848831394875
Encrypted:	false
SSDEEP:	96:KeEXeLhBvPUxfl3SqngHluwgYCuU7H/rk+W8jG2rk4jkXdlDNQ3:KjEvPU/fOluwzXGg+W8jG2rZjodFO3
MD5:	96846E8D3F08F26D7B86E4ACBF60AE32
SHA1:	1400B30606106843AA7FCC17E98D0ED4D521E089
SHA-256:	3D574893CC00FD6EDF8CF424F620EDD76AABB2BEE101960D445E2D441BFAC4A6
SHA-512:	616C052B95F33919F1B74A6CCA701A6530F044F45A50E6F6CF91C37929754238FDA97D2EBB4A402C3A2FB94CD598200E5D9DD0FC5D50A399007DBFF5BD4BD2E2
Malicious:	false
Preview:	.......2.....qt314/c0......java/lang/Object......java/lang/Runnable......c0.java...llIllIlIll...[Ljava/lang/String;...z...a...I...b...Ljava/lang/String;...lIIIlIlllIII...(II)Z...lIIIlIllIlll...(I)Z...lIIIlIlIlIll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets..!...UTF_8...Ljava/nio/charset/Charset;..#.$..".%...java/lang/String..'...getBytes...(Ljava/nio/charset/Charset;)[B..).*..(.+...digest...([B)[B..-....../...java/util/Arrays..1...copyOf...([BI)[B..3.4..2.5...DES..7...<init>...([BLjava/lang/String;)V..9.:....;...javax/crypto/Cipher..=..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....?..>.@...init...(ILjava/security/Key;)V..B.C..>.D...java/util/Base64..F...getDecoder...()Ljava/util/Base64$Decoder;..H.I..G.J...java/util/Base64$Decoder..L...decode..N....M.O...doFi

C:\jar\qt314\c1.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	5.698130620489314
Encrypted:	false
SSDEEP:	48:da5nvyRLYcDbX+5JLhnN8zJ3ELJMDrTP2tJHlm6uypMvF/Pxjov6b0BC9N+bejGg:nb+3VnGELJMLPWlNkZxcyb2u+q7ou
MD5:	FCEA9004B53B8613D9FED3F748060050
SHA1:	D41B1C88F823F277CFF5F8B5C13746109F7A43D8
SHA-256:	1D6E92077F3EE93EDDF7D96B1F43386CE8451EAB3A34B9EA3ADD092AAA62FFB0
SHA-512:	777A1B9139937F1DB98B2003207F214DBFD3ED7658AE96AE076F9308908F73E134901759E3D21366D4AD72D3FA2FA9DE906EA77CC130A53B02A0ABECE22EE74C
Malicious:	false
Preview:	.......2.....qt314/c1......java/lang/Object......c1.java...d...[Ljava/awt/Robot;...z...[Ljava/lang/String;...f...a...Z...e...Ljava/security/KeyPair;...c...[B...lllIIIllll...b...Ljava/awt/Robot;...()Ljava/lang/String;...qt314/cq......Ljava/lang/String;.............()Ljava/security/KeyPair;...java/lang/Exception................lIIlIIlIIIIl...(Ljava/lang/Object;)Z.... ....!.........#...java/security/KeyPairGenerator..%...getInstance..4(Ljava/lang/String;)Ljava/security/KeyPairGenerator;..'.(..&.)...initialize...(I)V..+.,..&.-...genKeyPair../....&.0...java/security/KeyPair..2...getPublic...()Ljava/security/PublicKey;..4.5..3.6...getPrivate...()Ljava/security/PrivateKey;..8.9..3.:...<init>..6(Ljava/security/PublicKey;Ljava/security/PrivateKey;)V..<.=..3.>...()[Ljava/lang/String;...l..A......B...lIIlIIIllIll...()V...java/lang/String..F.........H...UgQH..J...nGmnJ..L...lIIlIIIllIlI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;..N.O....P...eSM+MQ==..R...yFyXF..T...()[B.........W..

C:\jar\qt314\c2.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4710
Entropy (8bit):	5.847882872633671
Encrypted:	false
SSDEEP:	96:k7VEveLufso6XxFkH9Il4smqgln/23w0k+sTAZohWmn:kKETPkH9Il44g8kzA2hWmn
MD5:	D516FF9E142B5EB7E28CF7F38A0D7BFE
SHA1:	AF7B9504B3CC5218900424B380E1861FB6235C31
SHA-256:	3F689BF3390D4A7DC83B926FCBE5B32A14503BC89401128DFDFBE32584549F20
SHA-512:	92978AA65437DFFC7FCF5B906B077531D6615F18679101DF8A591D441245179D8C835075E7582C3E9EBDE3028D5D8F6682FBD15A0C4CB73E29C77D45DE10CD38
Malicious:	false
Preview:	.......2.....qt314/c2......java/lang/Object......c2.java...llllIIIlII...[Ljava/lang/String;...z...Ljava/lang/String;...<init>...()V.............lIIlllllllIl...(II)Z...lIIlllIIllIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.. .!...."...java/lang/String..$...getBytes...(Ljava/nio/charset/Charset;)[B..&.'..%.(...digest...([B)[B..*.+....,...java/util/Arrays......copyOf...([BI)[B..0.1../.2...DES..4...([BLjava/lang/String;)V....6....7...javax/crypto/Cipher..9..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....;..:.<...init...(ILjava/security/Key;)V..>.?..:.@...java/util/Base64..B...getDecoder...()Ljava/util/Base64$Decoder;..D.E..C.F...java/util/Base64$Decoder..H...decode..J.+..I.K...doFinal..M.+..:.N...([BLjava/nio/charset/Chars

C:\jar\qt314\c3.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3730
Entropy (8bit):	5.756510389743192
Encrypted:	false
SSDEEP:	96:sVOsm+KM2ECSnGdqol+33eyO6YLEbsoUtcSSE2Xf3:s8Mhnwl+3bcEbsoUtcSSt3
MD5:	64516672DED18DC5E92617E649E1205D
SHA1:	826DA35512122018AB9683AB0BB3F315AAD17B23
SHA-256:	55974889DB17E7F74B8828F2DF8F7FEA20528CB19BAFFE29092598149718A2AF
SHA-512:	EB4021DA9F9E53F04A23A2AD2C774FAF31D1B83DDBD1A995A396B1FE8715BEEE6B746104C1045BC706D77D8A1A984BE3D420208815515FB7FFB5990BB443D755
Malicious:	false
Preview:	.......2.....qt314/c3......qt314/cH......c3.java...z...[Ljava/lang/String;...lIlllIlllI...lllIIIlIIIl...()V...java/lang/String................25EJMNYPUog=......vXbmC......lllIIIIllll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............L28MJjY=......DNgKv......lllIIIlIIII.............lllIIIlIIlI...(I)Z...<init>...(Ljava/util/Map;)V.. .!...."...a...java/lang/Exception..%...qt314/cq..'...()Ljava/util/Map;..$.)..(.*.........,...java/util/Map......get..&(Ljava/lang/Object;)Ljava/lang/Object;..0.1../.2...java/lang/Boolean..4...parseBoolean...(Ljava/lang/String;)Z..6.7..5.8.........:...qt314/cA..<...java/lang/Integer..>...parseInt...(Ljava/lang/String;)I..@.A..?.B...(I)V.. .D..=.E...start..G....=.H.....J...length...()I..L.M....N... ..P...java/util/Base64..R...getDecoder...()Ljava/util/Base64$Decoder;..T.U..S.V..!java/nio/charset/StandardCharsets..X...UTF_8...Ljava/nio/charset/Charset;..Z.[..Y.\...getBytes...(Ljava/nio/charset/Charset;)[B..^._....`...java/util/Base64$Decoder

C:\jar\qt314\c4.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.4339539459596296
Encrypted:	false
SSDEEP:	6:0EeSRPoHNszY75wNneEbQo8Z8uPsu2V+lot/l/6lYv5THX/gn:1R2SHeEbQo8Z8uPOV+lov/62v5TH4n
MD5:	676142ED20839752DF0374627428ACBD
SHA1:	F4E623ED621F10B3D2146D9391AE5A64A4BC7410
SHA-256:	042899F3F618A070B6091786AFAD71790C3D78AE8A470036BAB7DD7E5000E6A2
SHA-512:	BFA0A1C94A8734F3FD2085509D6C73C0BFB091FBBCE60E7C2967F6A0D26BB4B41F6C725B1785179D8D8B90845E4F5E1833996D5EC8F9F0C957CD50CDCE1FB917
Malicious:	false
Preview:	.......2.....qt314/c4......java/lang/Object......c4.java...d...I...a...b...c...<init>...()V.............<clinit>...........................................Code...SourceFile.1................................................................*.....................!.........n....n....n....n..................

C:\jar\qt314\c5.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2714
Entropy (8bit):	5.739749292104119
Encrypted:	false
SSDEEP:	48:ZByL2sP9mfQRhV1YZ/EwHbb2HTYSDrwDH/HlUR5ym9nRIqWSmQ9uisRR9wj9K7/6:Z0L2sMIjV1i/EkbUD6l2cyRIcvKRgAG
MD5:	D80F3713E3A9723D68A55F1C2CDC5A2C
SHA1:	F294D2D63046D757E9C41F69AFEEDEA1476F9420
SHA-256:	24C5541732D655CE9FA24E6DFD5C1AE0D94019726B3676CE3D51FF20DE9CFAEC
SHA-512:	33C64B952F778313B49D33D33D8A11CD87B779D941D1B66335B48F1245D32E046D98262E862492948C3134073ED720CF35D4556DBEEBE0C952F8F8A8C9E1E006
Malicious:	false
Preview:	.......2.....qt314/c5......qt314/c7......c5.java...lllIIIlIIl...[Ljava/lang/String;...z...Ljava/lang/String;...lIIlIIIIIIIl...(I)Z...a...([B)[B...java/lang/Exception......I.......................java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;.............digest.............qt314/al......b...Z.. .!....".........$.....&...java/lang/String..(...length...()I..*.+..).,... ...... ..0...[B..2...<clinit>...()V...lIIlIIIIIIII..6.5....7.........9... ..;...toCharArray...()[C..=.>..).?...lIIlIIIIIIll...(II)Z..A.B....C...<init>...([C)V..E.F..).G...intern...()Ljava/lang/String;..I.J..).K...[C..M..E.5....O...yFpjwYPeY74=..Q...FNtRq..S...lIIIlllllllI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;..U.V....W...javax/crypto/spec/SecretKeySpec..Y...MD5..[..!java/nio/charset/StandardCharsets..]...UTF_8...Ljava/nio/charset/Charset;.._.`..^.a...getBytes...(Ljava/nio/charset/Charset;)[B..c.d..).e...java/util/Arrays..g...copyOf...([BI)[B..i.j..h.k

C:\jar\qt314\c6.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.2582649878568555
Encrypted:	false
SSDEEP:	6:30wSRPUzqzsWYsh1bQ4T2rzya1vRYcS/++loz1tn:32Rf20bQ46rzya15mvloz1t
MD5:	277ADE3AE3D20A921D461DDD1E97C54E
SHA1:	2F629900571FA4E38FBE2F7FC2E1A049D90EA673
SHA-256:	BC81BD5C5EDF3A34F38B836D4408A91D592E8B4543DC65D625A4F3F906CDE430
SHA-512:	27464B0E92B172FD76DCEBAC1FA98AA2FF9E35016D623EDD3D74344A3E4330871F0CF25EB2C767F4A373F44B5D8744FEF1C11578CD41EDA7C4F4512F62DB0D04
Malicious:	false
Preview:	.......2.....qt314/c6......java/lang/Object......c6.java...<clinit>...()V...a...()B...<init>.............Code...SourceFile.!........................................................................................*..................

C:\jar\qt314\c7.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3308
Entropy (8bit):	5.690147183424453
Encrypted:	false
SSDEEP:	48:tAm+bfvdF1LTEEgHV60DzGWvSsX/ou3Zl3bloBULNQthW18TXcc0v0QR/oq:SbfVFZEEUVR3ASZlrFNQthWpc0MQR/oq
MD5:	B236F05922BF290D9528A10945E40493
SHA1:	BC22FC4451037AB1856B18088C3AAADECD973B00
SHA-256:	ABFDDD5BDA0DDD652B9DB3555387128F7F216C993E1597C6F9F2B1C42F94C542
SHA-512:	71D42C79F0576DA7F2A7346118E9AAA838802EFD08B299C2A9E5C8A0801EC8029CDF3B3805906E57EE8938330189C2698E1895B6E124FEC21BC3E24A46C1DC52
Malicious:	false
Preview:	.......2.....qt314/c7......java/lang/Object......c7.java...z...[Ljava/lang/String;...a...I...llIIIlllII...b...(Ljava/lang/String;)[B...java/lang/Exception................java/lang/String......getBytes.............([B)[B.............llllIIllIlI...()V.............mT0/f99ZvBM=......arWbv......llllIIllIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;..!."....#...Ahi4KbaBCkU=..%...XEKBU..'..&(Ljava/lang/String;)Ljava/lang/String;...qt314/cz..*...([B)Ljava/lang/String;....,..+.-...javax/crypto/spec/SecretKeySpec../...MD5..1...java/security/MessageDigest..3...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..5.6..4.7..!java/nio/charset/StandardCharsets..9...UTF_8...Ljava/nio/charset/Charset;..;.<..:.=...(Ljava/nio/charset/Charset;)[B....?....@...digest..B....4.C...java/util/Arrays..E...copyOf...([BI)[B..G.H..F.I...DES..K...<init>...([BLjava/lang/String;)V..M.N..0.O...javax/crypto/Cipher..Q..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..5.S..R.T...init...(ILjava/secur

C:\jar\qt314\c8.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2626
Entropy (8bit):	5.702840084999001
Encrypted:	false
SSDEEP:	48:jsfLDFwwNhtf9ZKcEjehL86Il6fCmhdeAWFd/eUU5:jjchl3vEjewlSHhdeAWTmUK
MD5:	B935D99E05C0CC9C717D419409EAF796
SHA1:	94AB149F81D3F53A6E3A2925985D7A5B03DB4938
SHA-256:	E41B4F0F30DCDB644C686CE4700B98FFFB76D2CA227CD0EB5FF469DB9B893D0B
SHA-512:	73AF6F5EA26EA7A1164B0630C77A010EC6122B15580A19FF0E5087C51D1B54564A547C6686F7BEA11ABB2694EA24B137C10D4AFEAA1786D5C2FF13577F8CB284
Malicious:	false
Preview:	.......2.....qt314/c8......qt314/cH......c8.java...llIlIIlIll...[Ljava/lang/String;...lIIIIlIlIlll..'(Ljava/lang/Object;Ljava/lang/Object;)Z...lIIIIlIlIIlI...()V...java/lang/String................2hdEblRpQVk=......umTGt......lIIIIlIlIIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............<init>...(Ljava/util/Map;)V.............a...java/lang/Exception......qt314/ca......d...()Ljava/io/File;..!.".. .#...java/io/File..%...getAbsolutePath...()Ljava/lang/String;..'.(..&.)...qt314/cq..+...j...Ljava/lang/String;..-....,./...qt314/cJ..1...(Ljava/lang/String;)V....3..2.4.....6...length...()I..8.9....:... ..<...printStackTrace..>......?...qt314/ah..A...getOperatingSystem...()Lqt314/ah;..C.D..B.E...WINDOWS...Lqt314/ah;..G.H..B.I.........K...startsWith...(Ljava/lang/String;)Z..M.N....O...lIIIIlIllIII...(I)Z..Q.R....S... ..U... ..W...substring...(II)Ljava/lang/String;..Y.Z....[....3..&.]...exists...()Z.._.`..&.a...java/util/Date..c...lastModified...()J..e.f..&.g...(J)V....i..

C:\jar\qt314\c9.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.470182463624303
Encrypted:	false
SSDEEP:	6:TSezOKrUszG3klSXE1bQ4TOlZilOlozUKlWvI6n:gSBSU1bQ4jMlo4KlWg6
MD5:	23FB1ECC724B6D832C0BF00F4AE0F0B0
SHA1:	BA6C6237987163275E72CDA81E32983EEB296349
SHA-256:	30BD95D34FB2AD1E85B463921E412EA3D139C75577424B4E28216CA767885989
SHA-512:	58E19A05E6647976D266DF480E4D833C25408459E051DFAC77396C57DBDF68BCDF51EE4C35C562F1F42C0522AD0393A751AE1CF40EFD1C370C6C502820F9251E
Malicious:	false
Preview:	.......2.....qt314/c9......java/lang/RuntimeException......c9.java...<init>...()V.............<clinit>...Code...SourceFile.!................................*.............................................

C:\jar\qt314\cB.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4638
Entropy (8bit):	5.819036782437175
Encrypted:	false
SSDEEP:	96:O5+/GEd8KuZKEJebxYGlR2tqSvcAK4oW6H8E:O5+D4RylRsZcTHn
MD5:	67F4D94535D39F5889139DD31EFA3923
SHA1:	70E604CE9213C1BAFCDE5A2ECA9ABDA2BDBC0AA1
SHA-256:	11C942098D9CF22E2BE89E841EC7CEFE822F0A356463648AA633AC1EEDD63BCB
SHA-512:	86F68F5D6564488D899F8059A7F1735A59D4944DAEC6FDD62835AD235BCF981AEF6CA6BFF0E14C18FB00555AB3E914C6C5EDB372809BD97533DF877552EC3ADD
Malicious:	false
Preview:	.......2.....qt314/cb......java/lang/Object......cb.java...llIlllllll...[Ljava/lang/String;...z...Ljava/lang/String;...lIIIlllIllll...(I)Z...a.."(Ljava/awt/image/BufferedImage;)[B...java/lang/Exception....>.....#(Ljava/awt/image/BufferedImage;F)[B.............qt314/ca......b...I.............java/io/ByteArrayOutputStream......<init>...()V.............java/util/zip/GZIPOutputStream.. ...(Ljava/io/OutputStream;)V...."..!.#...javax/imageio/ImageIO..%...createImageOutputStream..<(Ljava/lang/Object;)Ljavax/imageio/stream/ImageOutputStream;..'.(..&.).........+...getImageWritersByFormatName..((Ljava/lang/String;)Ljava/util/Iterator;..-....&./...java/util/Iterator..1...next...()Ljava/lang/Object;..3.4..2.5...javax/imageio/ImageWriter..7...getDefaultWriteParam..!()Ljavax/imageio/ImageWriteParam;..9.:..8.;...javax/imageio/ImageWriteParam..=...setCompressionMode...(I)V..?.@..>.A...setCompressionQuality...(F)V..C.D..>.E...setOutput...(Ljava/lang/Object;)V..G.H..8.I...javax/imageio/IIOImage..K..U(Lj

C:\jar\qt314\cC.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3057
Entropy (8bit):	5.718285062621214
Encrypted:	false
SSDEEP:	48:rC+MHdHrh7EXeDHjNxPHl7ZF7j9wsa1+qDeEIlc1Lbf2B+Zp/fRdRZ+YH:W+M95EXeLjNNTF39xfqDslsLbOB+jrRn
MD5:	BAEF71DFAB2C5726BAA4889CD508FCE2
SHA1:	E5D2C6C4C1DCACF522764C3ECA230DCE6947727D
SHA-256:	AF7733F6A927063918AA2308DCF894D8D4F21950DBCA9D797728F955D6E7293F
SHA-512:	F1A0BB962B826D2E43E823AD3068D83C79FCB76D9EF9D0ACB895A3EF97C118EEC4EFA1C2062F92C78B0CC74332AB002B7C9180280CFD8F03936C66C2C9D32E1A
Malicious:	false
Preview:	.......2.....qt314/cc......java/lang/Object......cc.java...llIlllIIll...[Ljava/lang/String;...z...lIIIllIIIlIl...(II)Z...lIIIllIIIIII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............java/lang/String......getBytes...(Ljava/nio/charset/Charset;)[B..!.".. .#...digest...([B)[B..%.&....'...java/util/Arrays..)...copyOf...([BI)[B..+.,..*.-...DES../...<init>...([BLjava/lang/String;)V..1.2....3...javax/crypto/Cipher..5..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....7..6.8...init...(ILjava/security/Key;)V..:.;..6.<...java/util/Base64..>...getDecoder...()Ljava/util/Base64$Decoder;..@.A..?.B...java/util/Base64$Decoder..D...decode..F.&..E.G...doFinal..I.&..6.J...([BLjava/nio/charset/Charset;)V..1.L.. .M...printStackTrace...(

C:\jar\qt314\cD.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	12468
Entropy (8bit):	6.07896381446737
Encrypted:	false
SSDEEP:	384:7hOeaXDQ1yrMCnW4aLsxsXy1Y6MP2PlyHFRZXanaAvirlwJGgkcW:74DkQrU4amuwEgkN
MD5:	90B4DD7CBFDEDFAD6EF3864324BBAE6A
SHA1:	9AA37E65E3BB4B526A19713A213D612EC6B3B22B
SHA-256:	6ABBA5B4898B099D14B594069A2FF0A4A5DD896D79F7B333694D36B773BB13BC
SHA-512:	4D1A3888DEE5A7A4B3E5050F21C0A468177BDC267C4F312FB2541D9529E0C1592EC974AAC9FA28752F274970A95241165C43FF700BEDE250D48D13AAA7D72A4B
Malicious:	false
Preview:	.......2.....qt314/cd......java/lang/Object......java/lang/Runnable......cd.java...e...I...b...Ljava/io/InputStream;...i...Ljava/io/DataOutputStream;...f...Z...z...[Ljava/lang/String;...c...Lqt314/cS;...lllIlIIIII...k...Ljava/net/Socket;...d...Ljava/security/PublicKey;...j...Ljava/io/OutputStream;...h...g...Ljava/io/DataInputStream;...a...Lqt314/dE;...<clinit>...()V...lIIlIlIllIIl..".!....#...java/lang/String..%.........'.....)...length...()I..+.,..&.-... ../... ..1... ..3.........5...toCharArray...()[C..7.8..&.9...lIIlIllIIIIl...(II)Z..;.<....=...<init>...([C)V..?.@..&.A...intern...()Ljava/lang/String;..C.D..&.E.........G...qt314/s..I..?.!..J.K.........M......[C..P...lIIlIlIlIlIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception..T...javax/crypto/spec/SecretKeySpec..V...MD5..X...java/security/MessageDigest..Z...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..\.]..[.^..!java/nio/charset/StandardCharsets..`...UTF_8...Ljava/nio/charset/C

C:\jar\qt314\cF.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4850
Entropy (8bit):	5.790793675172179
Encrypted:	false
SSDEEP:	96:mOE/gJnUJJGVjJipMlNpl/fXEr8vLiSLYsnpIWD57dkNKHrwQLc:jJEwgKNpl/PBjigLONK0b
MD5:	03F6DACE9F36183E07353511BC4B4FC4
SHA1:	015C3B05DB833A02F261053C0F09D69C5E8008AF
SHA-256:	7C610B29AEBC231BFE2CC7FDDE4034F4A109F48BFC6C7FA282F3B2432B8BBB7F
SHA-512:	EE6CE189B791F3BB0C45C6E9164CD815F5F9A669100E2A7333ED26C6037FCBD42D56DE2F5F5AEAC2C48F5D59F06248E0E8A676A6818A77ADA60732FF0EBFDC86
Malicious:	false
Preview:	.......2.....qt314/cf......java/lang/Object......cf.java...z...Ljava/lang/String;...llllIIlIlI...[Ljava/lang/String;...lIIlllllIIII...()V...java/lang/String................NXRhdQ==......iNVZC......lIIllllIllll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............java/util/Base64......getDecoder...()Ljava/util/Base64$Decoder;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.. .!...."...getBytes...(Ljava/nio/charset/Charset;)[B..$.%....&...java/util/Base64$Decoder..(...decode...([B)[B..*.+..).,...<init>...([BLjava/nio/charset/Charset;)V..../....0...java/lang/StringBuilder..2.......3.4...toCharArray...()[C..6.7....8...lIIllllllIII...(II)Z..:.;....<...append...(C)Ljava/lang/StringBuilder;..>.?..3.@.....B...length...()I..D.E....F... ..H...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..J.K....L...keyChars...[C...obj...sb...Ljava/lang/StringBuilder;...i...I...c...C...key..O...lIIlllllIllI...(I)Z...a...(Ljava/io/DataInputStream;)V...jav

C:\jar\qt314\cG.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	393
Entropy (8bit):	4.760040394157861
Encrypted:	false
SSDEEP:	6:AlmdeyVPm4cNgEoXM6dv7ewqzsIJoXMVvyJbQ4Ts1dpA8l3MlCv9NKMZe:ALAdzEKMNMMYJbQ4gqlCFcv
MD5:	3742B8D0CD8A865D3C0AA31855BF44EF
SHA1:	49A200727C573B1C0A59538EDF740787D0CD4808
SHA-256:	53B2854CFE171D97F8A3A79C7B44E3B1B5ADA46022E66EC84F5DB9744400A0BC
SHA-512:	24FF4BF174F4D12B2D108306A8B45D2148C753CDA5AE2191763DC22327F1B7D4D2EE85CF600D792AE9D6CCF0059A0A01C80D7246D430A571F394AD24FE7FA529
Malicious:	false
Preview:	.......2.....qt314/cg......java/lang/Exception......cg.java...a...Z...<init>..(Ljava/lang/String;Ljava/lang/Throwable;)V.............<clinit>...()V...(Ljava/lang/Throwable;)V.............(Ljava/lang/String;)V.............Code...SourceFile.!........................................+,.........................................................+..............................+..................

C:\jar\qt314\cH.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	5359
Entropy (8bit):	5.871175046189529
Encrypted:	false
SSDEEP:	96:u7EXeHu9qQHwiKsvzMldjuB4Flb2nZeDl2DrDjHDD:uEAutHAtldiSNsZeDl2DLHDD
MD5:	65C5172CCB3F99283AAD6421D34EB370
SHA1:	46D6C2F52570C1598AD3AAD25CA1F618DA12363A
SHA-256:	9D059EC90409029BEB4E332465468D421E1248C37E227FA340F30009B6B36255
SHA-512:	426A2150E2F9AEA2D066C3845D3BB8944F7F0DC6768DBA703936F3F7039A4BCE149C427A727D9BCA4CC9437FDD993C06C2FA76D1E8754FF8FBC0B1607C7BC022
Malicious:	false
Preview:	.......2.....qt314/ch......java/lang/Object......java/lang/Runnable......ch.java...a...I...b...Ljava/lang/String;...z...[Ljava/lang/String;...llIlIIllIl...lIIIIlIlIlII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.... ....!...java/lang/String..#...getBytes...(Ljava/nio/charset/Charset;)[B..%.&..$.'...digest...([B)[B..).....+...Blowfish..-...<init>...([BLjava/lang/String;)V../.0....1...javax/crypto/Cipher..3..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....5..4.6...init...(ILjava/security/Key;)V..8.9..4.:...java/util/Base64..<...getDecoder...()Ljava/util/Base64$Decoder;..>.?..=.@...java/util/Base64$Decoder..B...decode..D...C.E...doFinal..G.*..4.H...([BLjava/nio/charset/Charset;)V../.J..$.K...printStackTrace...()V..M.N....O

C:\jar\qt314\cI.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	8248
Entropy (8bit):	6.04711217356631
Encrypted:	false
SSDEEP:	192:Q3Xi/ss+vP+B6lS2hAWloqQS1uDwLsb59UDqo8k/:QhsdgM2hTlomLs1Vo8C
MD5:	0172DCA86B709993D919AD53D40D1D00
SHA1:	2D7050DD22B8E91A4C0E3B1749779F6B6442EDC6
SHA-256:	9A32A73E0A3FB3083E5CDD11C01466CF22E700327E29AB2EFECE37A9E08ED08E
SHA-512:	5B2A10FAECE6115B5968C3666F768C4E58D329D91660549529F1C24CB001FE86FF27B316122968FB48A1046F7E77FE5261F3E63C9DB89835AF274D744784C069
Malicious:	false
Preview:	.......2.x...qt314/ci......qt314/cH......ci.java...z...[Ljava/lang/String;...lllIIIllII...lIIlIIIIIlll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............java/lang/String......getBytes...(Ljava/nio/charset/Charset;)[B.... ....!...digest...([B)[B..#.$....%...Blowfish..'...<init>...([BLjava/lang/String;)V..).*....+...javax/crypto/Cipher..-..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..../....0...init...(ILjava/security/Key;)V..2.3....4...java/util/Base64..6...getDecoder...()Ljava/util/Base64$Decoder;..8.9..7.:...java/util/Base64$Decoder..<...decode..>.$..=.?...doFinal..A.$....B...([BLjava/nio/charset/Charset;)V..).D....E...printStackTrace...()V..G.H....I...obj...Ljava/lang/String;...e...Ljava/lang/Exception;...keySpec

C:\jar\qt314\cN.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.935881778344983
Encrypted:	false
SSDEEP:	6:oEL6lNso6v183+kdiCy4c288IlIqvc3sdIrwSNgEOIHJDw04T2vmXl1375vEUm:w6v183+JYj8GUc3s+UEOIpDt46o55hm
MD5:	E172D6A173E102F5CC11E0CFC6D9326F
SHA1:	CD4C9F59053E321875EB8235BF87FCB1D198603A
SHA-256:	B8E255A3077424D45590B8FBA3D1BEB589382CA01E9967044EDC4A56F47F464C
SHA-512:	3CECC6B815DED3A38F7651B78B2646F3432C9E946DBDE8DCBD83EB2C77A8829F8518FEAFC8365AF4F0B622BFC0D92A984420353F1E1CA66907E4E969CAAA79B8
Malicious:	false
Preview:	.......2.....qt314/cn......qt314/cH......cn.java...a...()V...java/lang/Exception......java/lang/Thread......qt314/cd......<init>.............(Ljava/lang/Runnable;)V.............start.............<clinit>...(Ljava/util/Map;)V.............Code...Exceptions...SourceFile.!...................................Y...Y.........................................................................*+..................

C:\jar\qt314\cO.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	264
Entropy (8bit):	4.523461319750265
Encrypted:	false
SSDEEP:	6:MEbSRPh8ZzVo6SKDKeJbQElq1dpQlkP8lFlo3ZglXvq:URyU6SGbQElOs9lFloOlXi
MD5:	9D60EFDFE9C2BD9ED489F4A64FBA0A9E
SHA1:	DF9A83F7147F2694A68A994BCFCEFF0FFB20A63C
SHA-256:	09882A44F45C372D49BEC03A02D5C47374DB72B14C689EB278C02B5A4EB51789
SHA-512:	0105738746B068D2D0B303B7542BBB8098039B413A146A9B231363BEC841ED5906884E60671301AA97C2A35E36FA9CE406DC7D06145EBBF0667A11E1DBEF07AC
Malicious:	false
Preview:	.......2.....qt314/co......java/lang/Object......co.java...a...Z...()V...java/lang/Exception......<init>.............<clinit>...Exceptions...Code...SourceFile.!..........................................................*.............................................

C:\jar\qt314\cR.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	12727
Entropy (8bit):	6.08337825800946
Encrypted:	false
SSDEEP:	384:ZxXC1TbhAZH2W8eeu7YstyDjEZ6y93BdHktj:ZxXgbhAAQVxO
MD5:	118934DADDFAC19F5D5F87D9301CBCD3
SHA1:	8AD6AF298214606A15F014D22459BDB651F2A768
SHA-256:	EE0B6F1A5237768AC6A1699DBF77D7A8F13D40B6F37608F5DCABF0C2794BE310
SHA-512:	54BA3BA7D2D6C58141D58E8090F3CD216B61274B3CC2C2EAAECDF610F0D6C6E827524E00820B5D1860E30CB914F251F8E879878FDB2BADA1F39CBD636C9101CF
Malicious:	false
Preview:	.......2.....qt314/cr......java/lang/Object......cr.java...k...I...q...n...b...lllIIlIllI...[Ljava/lang/String;...p...Ljava/lang/reflect/Method;...z...f...Ljava/util/prefs/Preferences;...h...i...Ljava/lang/Class;...t...j...e...d...o...g...m...s...r...c...a...l..9(ILjava/lang/String;Ljava/lang/String;)Ljava/lang/String;.. java/lang/IllegalAccessException.."..+java/lang/reflect/InvocationTargetException..$.."java/lang/IllegalArgumentException..&........lIIlllIllIll...(II)Z..).....+.........-..V(Ljava/util/prefs/Preferences;ILjava/lang/String;Ljava/lang/String;)Ljava/lang/String;..../....0..............3...java/lang/StringBuilder..5.........7...<init>...(Ljava/lang/String;)V..9.:..6.;...append...(I)Ljava/lang/StringBuilder;..=.>..6.?...java/lang/String..A...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..C.D..B.E..'.;...(Ljava/lang/String;)[B...length...()I..I.J..B.K.....M...charAt...(I)C..O.P..B.Q...lIIlllIllllI..S.....T...[B..V...(ILjava/lang/String;)V..3(Ljava/util/prefs/Preference

C:\jar\qt314\cS.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3147
Entropy (8bit):	5.731285090860932
Encrypted:	false
SSDEEP:	48:uldQXKkE/X4SBwdV4vxQvS8LcUPbRWdlIlxoadIggmEreydksQmHihHO5Dunu34H:3XE/LI46qUcLelxoVvk1PhHO5Dunq4H
MD5:	DD723DF6EE0E74AE7FD9990C1B7BD18B
SHA1:	C4B32E7CF8E18EA68C0DF8A3FA72B7717BE7CFCD
SHA-256:	C53BD76D711403BEF11B3CCBCF69BB64469CE57403F92202C2274109E70C57DC
SHA-512:	4220922D0D7CE664733ECE54F5686AA74DE762B06613E8117CA0B1210150FA7090468871DF0A03B675B592508495E480762EBC8A069C002FB72A971CEFF76EAA
Malicious:	false
Preview:	.......2.....qt314/cs......qt314/cH......cs.java...z...Ljava/lang/String;...lllIllllIl...[Ljava/lang/String;...lIIllIllIlll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/String......java/util/Base64......getDecoder...()Ljava/util/Base64$Decoder;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............getBytes...(Ljava/nio/charset/Charset;)[B.............java/util/Base64$Decoder......decode...([B)[B.. .!...."...<init>...([BLjava/nio/charset/Charset;)V..$.%....&...java/lang/StringBuilder..(...()V..$...).+...toCharArray...()[C..-....../...lIIlllIIIllI...(II)Z..1.2....3...append...(C)Ljava/lang/StringBuilder;..5.6..).7.....9...length...()I..;.<....=... ..?...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..A.B....C...key...obj...c...C...keyChars...[C...i...I...sb...Ljava/lang/StringBuilder;..J...(Ljava/util/Map;)V..$.P....Q...lIIlllIIIlII...(I)Z...lIIlllIIIlIl...lIIlllIIIIll...<clinit>...lIIllIlllIII..X.....Y.........[

C:\jar\qt314\cT.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.982763795059749
Encrypted:	false
SSDEEP:	12:IkU3aNwMAkldNeklQ7McTiFkMOOEKM31zkd4+vn/zlMGn3B41Zftf8MV4lyROvlA:2aNt3iH7r1zuZv/zmG3Borf8MvRO9ucq
MD5:	E6FA646A98FB9DABB6F1C30B4863409F
SHA1:	1EEA40EBCAE88CE06F83074156F4FA01D2D2D7B5
SHA-256:	96FA9CBC4BD4C02B755C5611371884B3FB8FCE7B96EA1797AAD7F1EFB7B31C77
SHA-512:	9809C25B1E123DAF214D7977DC13183753F5CE13E9F2E838227349558755B2675F73C6946F871A9CBA0C724DFF09AB624C002339D12CF7838014275A60FFC6E9
Malicious:	false
Preview:	.......2.....qt314/ct......java/lang/Exception......ct.java...<init>..,(Ljava/lang/String;Ljava/lang/Throwable;ZZ)V...qt314/t......a...I.......................qt314/al......b...Z.............lIIllIIlIIlI...(I)Z.............java/lang/String......java/lang/Throwable......(Ljava/lang/Throwable;)V.............<clinit>...()V...(Ljava/lang/String;)V....#....$...."....&..(Ljava/lang/String;Ljava/lang/Throwable;)V....(....)...Code...StackMapTable...SourceFile.!...................+...G....... ...6.+,.............................,..................................+............+.. ........!."...+......................#...+............+..%..............+...!.......................,.......@......"...+..............'..........(...+............+,..*........-......

C:\jar\qt314\cU.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2680
Entropy (8bit):	5.69990341634294
Encrypted:	false
SSDEEP:	48:VlTINxO0E+8eDMZ3y7vvzMCl3iNprJr8fK1nS8p7C6:QE+8eS4wClSndeCt
MD5:	73B872ACF85AF78F209FDECEAA4A535A
SHA1:	3AEA7A2BC8E537C21790297144579EFE6E7B1180
SHA-256:	A01695D3B54CFDAAA227D5B5C1340AAF60E708EA0E7AED572FA2372A7DC3763B
SHA-512:	36EF6F5A3EB6647DD1CA1A1C2E887C4E6DBEF031B2638F699CD1C6DCCE160C0BB4E665958D204B3A67CE27D53BC1D4A455162CCE78913DE33E84EAD04DFA4071
Malicious:	false
Preview:	.......2.....qt314/cu......java/lang/Object......cu.java...z...Ljava/lang/String;...lllIIlllII...[Ljava/lang/String;...lIIlIlIIlIII...()V...java/lang/String................snHYBWNqRZE=......jmPRh......lIIlIlIIIlIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;.. .!...."..!java/nio/charset/StandardCharsets..$...UTF_8...Ljava/nio/charset/Charset;..&.'..%.(...getBytes...(Ljava/nio/charset/Charset;)[B..*.+....,...digest...([B)[B..../....0...Blowfish..2...<init>...([BLjava/lang/String;)V..4.5....6...javax/crypto/Cipher..8..)(Ljava/lang/String;)Ljavax/crypto/Cipher;.. .:..9.;...init...(ILjava/security/Key;)V..=.>..9.?...java/util/Base64..A...getDecoder...()Ljava/util/Base64$Decoder;..C.D..B.E...java/util/Base64$Decoder..G...decode..I./..H.J...doFinal..L./..9.M...([BLjava/nio/charset/Charset;)V..4.O....P

C:\jar\qt314\cZ.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	5582
Entropy (8bit):	5.959394139147083
Encrypted:	false
SSDEEP:	96:s2EXe7/43ssqN5Rev7hz7lLAwcn+eAQVLoqn0wSKZRFWisp1GX6LOwqL+27ngcU:2KcJtlsZ+3UaXakZ
MD5:	E183CE48CB592E97F1298B9E0252ABE5
SHA1:	7FAFE3CC5A32E87D97FE37DC080530E94EAE38FD
SHA-256:	C5F9EC37C510985C0DA06DEA9B834CFE8E13C1BE8691E0F9C4D807D183A4A1DE
SHA-512:	88543277B1EF539B60ECAC017A36A80C9A87DBE398E4D2A5FBAD8799F8C88D441AA6A7C90F640343AF3EA04071F5F757F7C88D5BE7F830FC3C0B95A160E11D52
Malicious:	false
Preview:	.......2.....qt314/cz......java/lang/Object......cz.java...c...[C...z...[Ljava/lang/String;...a...b...Z...llIIllllII...lIIIIIIlIIll..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;......... ...java/lang/String.."...getBytes...(Ljava/nio/charset/Charset;)[B..$.%..#.&...digest...([B)[B..(.)....*...java/util/Arrays..,...copyOf...([BI)[B..../..-.0...DES..2...<init>...([BLjava/lang/String;)V..4.5....6...javax/crypto/Cipher..8..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....:..9.;...init...(ILjava/security/Key;)V..=.>..9.?...java/util/Base64..A...getDecoder...()Ljava/util/Base64$Decoder;..C.D..B.E...java/util/Base64$Decoder..G...decode..I.)..H.J...doFinal..L.)..9.M...([BLjava/nio/charset/Charset;)V..4.O..#.P...printStackTrace...()V

C:\jar\qt314\c_.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4568
Entropy (8bit):	5.736343977880355
Encrypted:	false
SSDEEP:	96:5wn8NefpexwZExZCLsMseluB8kamjhBsy7FuMM22mMsxggtR:5w8Neoxz6/lahh5BJPxxR
MD5:	A864141B63156B37C9AF202AF41685DE
SHA1:	AC4E077D720919E0EDF6871C110083098949BC72
SHA-256:	189E7E039E5688EEFAB26CB75EEEC8B600444C7097A74125AA183FCE746DF344
SHA-512:	662F455C74CB386B63541DCB6DA4C69769D42A2C28D3C4A201122CEB354462369A2AE1839E4BB74835A84336D1244F5F62E514FFA5635CD9B088149FAB56C588
Malicious:	false
Preview:	.......2.....qt314/c_......java/lang/Object......c_.java...a...I...llIIllllll...[Ljava/lang/String;...b...z...c..:(Ljava/lang/String;[BLjava/lang/String;)Ljava/lang/String;...java/lang/Exception......sun/misc/BASE64Decoder......<init>...()V.............decodeBuffer...(Ljava/lang/String;)[B.............java/lang/String......([B[BLjava/lang/String;)[B.......................([BLjava/lang/String;)V....!....".......((Ljava/lang/String;[B)Ljava/lang/String;.........&..+([BLjava/security/Key;Ljava/lang/String;)[B...javax/crypto/Cipher..)...getInstance..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..+.,...-...init...(ILjava/security/Key;)V../.0...1...doFinal...([B)[B..3.4..*.5...([B[B)[B.........8...<clinit>...lIIIIIlIlIlI..;......<.........>.........@.........B.....D...length...()I..F.G....H... ..J... ..L...toCharArray...()[C..N.O....P... ..R...lIIIlIlllIlI...(II)Z..T.U....V...([C)V....X....Y...intern...()Ljava/lang/String;..[.\....]......[C..`...lIIIlIlllIll...javax/crypto/spec/SecretKeySp

C:\jar\qt314\ca.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	544
Entropy (8bit):	5.088977881010613
Encrypted:	false
SSDEEP:	12:Z+8PQELyNshWRP6J20R7MDnTS01zkd4jt9+oNNU4X:ZXLyNscP6haTJ1zuc04X
MD5:	28F6534A6805B7D97CDC2BA5040D8FC6
SHA1:	BDBF7F9C1BC2552A24F37F3B74E7856714367075
SHA-256:	76B1D58749318BBB3E7C7A92FF4D50F7666B532E2F64DCDAC3FAFB7C9C14C5EE
SHA-512:	E83A3104C46AD2F0864F7EB5FFE460DC4C6BFC8650341C5E1AC2AE40B25290F207945EA99AB5CA8896D06B0BC4B519841DA094C3AE05781D8C7742BC3F68E6B1
Malicious:	false
Preview:	.......2.-...qt314/cA......java/lang/Thread......cA.java...b...Ljava/net/ServerSocket;...a...I...<init>...(I)V...()V.......................run...java/lang/Exception......java/net/ServerSocket................................java/lang/String......length...()I......... ... .."...java/lang/System..$...exit..&....%.'...<clinit>...Code...StackMapTable...SourceFile.!.......................................................................D.......#...Y.............!W.#..!....L...(..............+......].......).........................,......

C:\jar\qt314\ce.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3013
Entropy (8bit):	5.708417670675691
Encrypted:	false
SSDEEP:	48:VIKGtCE1AEe8edAeUUvodZLivrlcIlDANRGYI9iYi05reLDMod8WOJ1a:V+tFAEbePo2vr1lkNRKU05qS3JA
MD5:	C246BC3BB74E1DDBE5AC6324D780DCFD
SHA1:	21AC0A0B4734D99F2ECCF9DE3F5486350FBC386D
SHA-256:	A41802F032C611C6212370D44FB2829EFAF936B555AE788A37A470BFA8224A25
SHA-512:	0000C2FCE40E13FB8E13B84279F3EC17B9079C6E4D22089852A10F2602A04A3A89EB69DC77F0350A8E78D12EDF4E4F2DC09A107EF3DEEB18124AC18585467EA4
Malicious:	false
Preview:	.......2.....qt314/cE......qt314/al......cE.java...llIlIIIlll...[Ljava/lang/String;...z...Ljava/lang/String;...lIIIIlIIIlII...(I)Z...lIIIIlIIIIlI...()V...java/lang/String................icRQSYwWtG4=......TXzNF......lIIIIlIIIIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest.. ...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..".#..!.$..!java/nio/charset/StandardCharsets..&...UTF_8...Ljava/nio/charset/Charset;..(.)..'.*...getBytes...(Ljava/nio/charset/Charset;)[B..,.-........digest...([B)[B..0.1..!.2...Blowfish..4...<init>...([BLjava/lang/String;)V..6.7....8...javax/crypto/Cipher..:..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..".<..;.=...init...(ILjava/security/Key;)V..?.@..;.A...java/util/Base64..C...getDecoder...()Ljava/util/Base64$Decoder;..E.F..D.G...java/util/Base64$Decoder..I...decode..K.1..J.L...doFinal..N.1..;.O...([BLjava/nio/charset/Charse

C:\jar\qt314\cj.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	13271
Entropy (8bit):	6.3083997333102255
Encrypted:	false
SSDEEP:	192:zMZeWRUqn8H5YajhfCUlluPzHrgRDubJudkIW/oRNnu2PF9xll4Z5FNv:zMZeWyqn8ljhfC2U7LXbci+RNnt9yXv
MD5:	E72601FDFD879EDDD1C3CA0EFD638AE9
SHA1:	36771B645E0744CDE2115C9D46CE062A3E972487
SHA-256:	8AA28880EFA332FD5667ABCE600246AA7DDBB1F7A6CC97B231C2CA5D7FF4B15D
SHA-512:	CD334DEAFF7197B5FA90E5DEB4DBC8151004C81D7955817E06B9F0E0E840F37F0E2437FC59AE47486D0EF43262E9F161BB540C279EE0AF37AD8259504B2A7CD9
Malicious:	false
Preview:	.......2.$...qt314/cJ......java/lang/Object......cJ.java...z...[Ljava/lang/String;...lllIlIlIll...lIIllIlIIIll...(I)Z...lIIllIlIIllI..'(Ljava/lang/Object;Ljava/lang/Object;)Z...lIIllIIllIll...()V...java/lang/String................EDn4DTTEBmE=......gMQwI......lIIllIIIIIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............g9ydCmUnJEE=......DgeED......sPPun3p8haY=......qEuQa..!...esZoUZ1RpHo=..#...VJrHZ..%...lIIllIIIIlII..'......(.....*...uOOzZ..,...lIIllIIIIlIl........./...fK7qeAX0lOw=..1...PewKr..3...7duGtxvTQiw=..5...mmxtZ..7...fxQyuTLayl4=..9...BqiqD..;...Tw==..=...hkuSx..?.. h6lej2t0f0K5nYibGtRmgNSxolufAsU0..A...QMhLT..C..(TDE9S2MJaCMnegN2bxZlLWN6AmUJf2kENEN6eA42..E...fQsBj..G...gZTDETzyc4iQWsloxYjlZg==..I...erRae..K...91uUUtpQPWt1zK+vN1vo0Q==..M...iNNyY..O..`mVOL0Ho+O8/I1YpKDr11RJMmPx2L2SpeOrx449s4oJ8AG/0TcbLu0DOj3w8gAWcPi7oMkAqXH3gZ5FhUMdx2ZPkaCxibMnS+..Q...JQvJc..S...znFvjBExKGPC8C4AtnPvFQ==..U...OVtwy..W...RR1l..Y...ormMZ..[.. +ZW0POqHjZyBGdio18M6U/Q2tsLxTkoQ

C:\jar\qt314\ck.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2349
Entropy (8bit):	5.655441814968097
Encrypted:	false
SSDEEP:	48:6mleMpRsmdEerVsueMvWhIvhIDrlIlr9USOfN9t395EHFkFOnqY:6xM9EmRLW26PelY95cqY
MD5:	344383EDAA8E359AEEAA9A7F6CC385A2
SHA1:	016F54005BBF3A3C3DEAFD46AD604B5F91E79F86
SHA-256:	0C9D47069DEA9F9AFDCA3041FF4AA3C95F8ED182AD2F46A12DEA6412F53DE52A
SHA-512:	30F4CDA87C85FDD1F0263761DDB528CCBD75D306D551A2C6E050F5DD95D5BDA0F967967E01A4C402317F53E75025A2ED1FF16B8406BB99DB7BA9C1F3523AABF4
Malicious:	false
Preview:	.......2.....qt314/cK......qt314/c7......cK.java...z...Ljava/lang/String;...lllIllIllI...[Ljava/lang/String;...a...([B)[B...java/lang/Exception................java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;.............digest.............lIIllIlIIIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...javax/crypto/spec/SecretKeySpec......MD5.....!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;..!.".. .#...java/lang/String..%...getBytes...(Ljava/nio/charset/Charset;)[B..'.(..&.)...Blowfish..+...<init>...([BLjava/lang/String;)V..-....../...javax/crypto/Cipher..1..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....3..2.4...init...(ILjava/security/Key;)V..6.7..2.8...java/util/Base64..:...getDecoder...()Ljava/util/Base64$Decoder;..<.=..;.>...java/util/Base64$Decoder..@...decode..B....A.C...doFinal..E....2.F...([BLjava/nio/charset/Charset;)V..-.H..&.I...printStackTrace...()V..K.L....M...e...Ljava/lang/Exception;..

C:\jar\qt314\cl.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1431
Entropy (8bit):	5.486577550540677
Encrypted:	false
SSDEEP:	24:kqN96847DsxvCyoxM6kbhq4d1zpt0ZCBKR9YV/N9OhWI6V:kqNl4WvCygLklqQpt6oKQvU10
MD5:	0B96FE08DC7E5BE13A65F51FCDA6ED2B
SHA1:	C0D4445839E92E3D00795DA7035D012F1AF5C466
SHA-256:	E5C5E22FED5EDEBEC510E3282817C2F77E00C8FDB5DF56F5F4B484AF55A2DD58
SHA-512:	0B366B37C35728A88A3CD6F042767C8703CE7D4EC0483FCEA03D8E1D28CC9F87AFB0A4CD25739D8CC61B9DEA39DAAB26CD865E18872DCE634A82FA802A1E0963
Malicious:	false
Preview:	.......2._...qt314/cL......java/lang/Object......cL.java...c...Ljava/io/DataOutputStream;...d...Ljava/security/KeyPair;...a...Ljava/security/PublicKey;...b...Ljava/io/DataInputStream;...()V...java/lang/Exception......qt314/c_......I.......................java/io/DataInputStream......readInt...()I.............readFully...([B)V......... ...qt314/cc.."...([B)Ljava/security/PublicKey;....$..#.%.........'...lIIllllIlllI...(I)Z..).....+...qt314/al..-...Z..../....0.....2...java/lang/String..4...length..6....5.7... ..9...[B..;...()Ljava/security/PublicKey;...<init>..M(Ljava/io/DataInputStream;Ljava/io/DataOutputStream;Ljava/security/KeyPair;)V..>......@.........B.........D...java/security/KeyPair..F...getPublic..H.=..G.I...java/security/PublicKey..K...getEncoded...()[B..M.N..L.O...java/io/DataOutputStream..Q...writeInt...(I)V..S.T..R.U...write..W....R.X...<clinit>...Code...StackMapTable...Exceptions...SourceFile.!...................................................[...........X...>......<...M

C:\jar\qt314\cm.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2905
Entropy (8bit):	5.680545722059532
Encrypted:	false
SSDEEP:	48:/yBK1VMiFYNSTnJEynIsuPXvIlSEGmqgpe5h2Vu8HFSTzt/TXI:/xcN6EynVuIlugtVuSSlT4
MD5:	F03AFD6ADA78A51EF7DB2244506EA495
SHA1:	106B33E822ED9CB5FBDD9ED3E8E61A313E6DFAA7
SHA-256:	B0896EB1473551249B52244902446C3295C80ED6C63AC724BD2274F371F4FCD2
SHA-512:	3D71255A9FDB8A8CABF47BA705F4785366C04343575FDB4732108E6F9175FDFAFF2C6F5B0D2F410A39E56C72357BE7E041F5EE08CFE3751A2E1DFF8E1EDC1F9A
Malicious:	false
Preview:	.......2.....qt314/cM......qt314/cH......cM.java...lllIIlllll...[Ljava/lang/String;...z...lIIlIlIlIlll...(II)Z...lIIlIlIlIIlI...()V...java/lang/String................ZQQd......LWWan......lIIlIlIlIIIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............ZCoLRkQ=......MyALO......<init>...(Ljava/util/Map;)V.............a...java/lang/Exception.."...qt314/cq..$...()Ljava/util/Map;..!.&..%.'.........)...java/util/Map..+...get..&(Ljava/lang/Object;)Ljava/lang/Object;..-....,./...java/lang/Boolean..1...parseBoolean...(Ljava/lang/String;)Z..3.4..2.5...lIIlIlIlIllI...(I)Z..7.8....9...qt314/cy..;...java/lang/Integer..=...parseInt...(Ljava/lang/String;)I..?.@..>.A...(I)V....C..<.D...start..F....<.G.....I...length...()I..K.L....M...java/util/Base64..O...getDecoder...()Ljava/util/Base64$Decoder;..Q.R..P.S..!java/nio/charset/StandardCharsets..U...UTF_8...Ljava/nio/charset/Charset;..W.X..V.Y...getBytes...(Ljava/nio/charset/Charset;)[B..[.\....]...java/util/Base64$Decoder.._...decode.

C:\jar\qt314\cp.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	6021
Entropy (8bit):	5.885318406949583
Encrypted:	false
SSDEEP:	96:DbZ6NLqEnerfNjZ4ELZAiz9wSplTUOekBPa/Gd8lpqj:8VfiGEDwSplw5wKDkj
MD5:	CB5A2993F22CD9D52F934161FD3A665C
SHA1:	C53D49D75F411416038542A059B6ED6577B6FCA2
SHA-256:	C52C83AC53D4869D20F30EFC4C0DA1DB0991CEA508AD2118E5AED99D943133F3
SHA-512:	C2FA8B0D8996417561598BC728F26D6C55C58FA11FC1996081F52263AAA1354464CE38B56215BDEC5401CC33C34D5AF50F1FE15AE81B9D46F302478109FFCB8E
Malicious:	false
Preview:	.......2.#...qt314/cP......java/lang/ClassLoader......cP.java...b...Ljava/util/HashMap;...llIIIlIIlI...[Ljava/lang/String;...a...z...llllIIIIIIl...(I)Z...lllIllllllI...(Ljava/lang/Object;)Z...lllIlllllll...(II)Z...llllIIIIIlI...hashCode...()I...getParent...()Ljava/lang/ClassLoader;.............java/lang/Object................lllIllllIII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec..!...MD5..#...java/security/MessageDigest..%...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..'.(..&.)..!java/nio/charset/StandardCharsets..+...UTF_8...Ljava/nio/charset/Charset;..-....,./...java/lang/String..1...getBytes...(Ljava/nio/charset/Charset;)[B..3.4..2.5...digest...([B)[B..7.8..&.9...java/util/Arrays..;...copyOf...([BI)[B..=.>..<.?...DES..A...<init>...([BLjava/lang/String;)V..C.D..".E...javax/crypto/Cipher..G..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..'.I..H.J...init...(ILjava/security/Key;)V..L.M..H.N...jav

C:\jar\qt314\cq.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.420523887171121
Encrypted:	false
SSDEEP:	24:cZ7SlgP6o0GGDfVALfzrocWbwhzuF8rjcQWAOWlsv+Q7CHKKZtOld:cZ7SlK2DfO7ocUwN/jcQW6av+pHKKZ8/
MD5:	2CAD93ACF66E759DEDEEF29080896AD6
SHA1:	3D7E36F036F0AA7B38CCFD7246B15A36E8533195
SHA-256:	0DAB7AEB76B7A71AF26728E21DC26607E10D5FAD264BE1E4047188DB265305B3
SHA-512:	29D2840102FC53F84233EDEC5998C337095DC6800799D6E5D10AACE8E0E39678A6527B4B53D73888201356C775D8477149B7A6CAC9698972927C759DA83B5BB6
Malicious:	false
Preview:	.......2.P...qt314/cQ......java/lang/Object......java/lang/Runnable......cQ.java...a...Ljava/lang/String;...<clinit>...()V...run...java/lang/Exception......qt314/cC......b...Z.............lIIIlIIIllll...(I)Z.............java/io/BufferedInputStream......java/net/URL................<init>...(Ljava/lang/String;)V.... ....!...openStream...()Ljava/io/InputStream;..#.$....%...(Ljava/io/InputStream;)V....'....(...read...([BII)I...+....,...lIIIlIIlIIII...(II)Z..../....0...lIIIlIIlIIIl..2......3...close..5......6.....8...java/lang/String..:...length...()I..<.=..;.>... ..@...printStackTrace..B......C...qt314/f..E.......F.G...[B..I.........K...Code...StackMapTable...SourceFile.!.............................M..........................M...............6........}...Y...Y....."..&..)L.....M+,......-Y>...1...+....4....7.9..?W.#.\|..........;...`...d.c`.....`...d...`..A..?t.~....L+..D..H..4.........G.......N...8.............................J....@.....W..................../...M...".....................

C:\jar\qt314\cv.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	3481
Entropy (8bit):	5.735198561796708
Encrypted:	false
SSDEEP:	48:ecNbqPRJhm3pxTjSEhQexsIlVDt79TYkxLHl6qXOO60/mm7gzfKR0OpP2TBU3o:eW+9iuEhQe3l98Wl6q7ZSfKRTpP2TBU4
MD5:	F9E323B0820AC32F26FD37177241861A
SHA1:	8C2A85314654363526CF49D0D2A3F668AAD0277B
SHA-256:	00A3E1A5ED19F1884AFE8FB28096B1C579F2767F05DDD6B57E1D30BEDD069241
SHA-512:	858E5A62987FA8443638C4E4A002B633FE3FDC26489E466F9B2151067A2E93DF1785C37B1B26FC11EE3755C57F2F40E0C7AAF9FFCB427D2C82C5FAF93C3C37E8
Malicious:	false
Preview:	.......2.....qt314/cV......qt314/cH......cV.java...z...[Ljava/lang/String;...llIllllllI...a...()V...java/lang/Exception......qt314/ah......getOperatingSystem...()Lqt314/ah;.............OSX...Lqt314/ah;.............lIIIlllIlIII..'(Ljava/lang/Object;Ljava/lang/Object;)Z.......................java/lang/System......setProperty..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.... ....!.....#...java/lang/String..%...length...()I..'.(..&.)... ..+...lIIIlllIlIIl...(II)Z...lIIIllIllIlI...javax/crypto/spec/SecretKeySpec..0...MD5..2...java/security/MessageDigest..4...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..6.7..5.8..!java/nio/charset/StandardCharsets..:...UTF_8...Ljava/nio/charset/Charset;..<.=..;.>...getBytes...(Ljava/nio/charset/Charset;)[B..@.A..&.B...digest...([B)[B..D.E..5.F...Blowfish..H...<init>...([BLjava/lang/String;)V..J.K..1.L...javax/crypto/Cipher..N..)(Ljava/lang/String;)Ljavax/crypto/Cipher;..6.P..O.Q...init...(ILjava/security/Key;)V..S.T..O.U...ja

C:\jar\qt314\cw.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.494696893870461
Encrypted:	false
SSDEEP:	3:Dblla30XlXF6jQCK8Po+6Nm9HabHezswQ8KQXXRYHJlllnyKXN1all/l1lQ:SEjSRPR8m9HaqzswQbQ++KdIlXvQ
MD5:	AF76BF621D6D781F1A183F9F16AF3913
SHA1:	13108FB653AD93D9BE3FF2306FD61E351F8216DF
SHA-256:	3D5BC96DCDB37FB7D2C4EF9F3108E31CE5E3FE14B71E4BB47199B3B08D57E101
SHA-512:	2E4D21F89BDD124C4B9AA523404F2FEF837CC54A432FDC5523215743B19AD745A890F1806448B69E5E49C098A1200C8CA22A8B4BF327E16E187815E2B3163896
Malicious:	false
Preview:	.......2.....qt314/cW......java/lang/Object......cW.java...a...(JJJ)V...<clinit>...()V...Code...SourceFile.........................................................

C:\jar\qt314\cx.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	5.499246458900751
Encrypted:	false
SSDEEP:	24:9LMHV9SaTLztiuEzzqCeUQT7aNDj0WgSTzxslzzVwBGiqzIljchAGsyE8lm8PPM/:9Lw7FiuEfejHaN/04kEGiKIlOKyeqPM/
MD5:	DE0C736A43FA9E70C057807091B79571
SHA1:	262DA6E1FC9C97ECD9BFAC69B39EEA2D85F08936
SHA-256:	785A2A71E33F7B99EB00AF73756B9F1F001AEAD284B8583503B5C61C0D96F7FF
SHA-512:	1FA08ABC3ED00D6BCFEA844AE2D64CB7030329F8650E6DFFE5FE740C00660510229F267290153084A4066DC561FC14B5B6EDDA1DD28F2D63796B1B666D51B1CE
Malicious:	false
Preview:	.......2.n...qt314/cX......java/lang/Object......cX.java...lllIlllIII...[Ljava/lang/String;...lIIllIlIlIlI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.............java/lang/String......getBytes...(Ljava/nio/charset/Charset;)[B......... ...digest...([B)[B..".#....$...java/util/Arrays..&...copyOf...([BI)[B..(.)..'.*...DES..,...<init>...([BLjava/lang/String;)V..../....0...javax/crypto/Cipher..2..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....4..3.5...init...(ILjava/security/Key;)V..7.8..3.9...java/util/Base64..;...getDecoder...()Ljava/util/Base64$Decoder;..=.>..<.?...java/util/Base64$Decoder..A...decode..C.#..B.D...doFinal..F.#..3.G...([BLjava/nio/charset/Charset;)V....I....J...printStackTrace...()V..L.M....N...e...Ljava/la

C:\jar\qt314\cy.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	387
Entropy (8bit):	4.66456263411522
Encrypted:	false
SSDEEP:	12:OHR5g/MO8CM3NnM8bQ4oLk01ovlol8D//vlozW:M06X0fL/1wicFH
MD5:	90E5E21DA4D3214D7CF397C291C67E61
SHA1:	CC03515B89481C7E94F5BFA5773896961F4BD4AB
SHA-256:	A693B76E54619F744CE87344F8B710CE457303F547B60E89C971442CBBC7AB88
SHA-512:	30B8AB3E3903518397CD1C2FD16C586927D22E8EE66F4D584E72D0972757844CC307C60E7701FC07B919969359AE2DB072A0961284C1B3F92F75FD399A12C417
Malicious:	false
Preview:	.......2.....qt314/cY......java/lang/Object......cY.java...a...Ljava/lang/String;...b...I...<clinit>...()V...()Ljava/lang/String;.............<init>...(Ljava/lang/String;I)V.......................()I...Code...SourceFile.!............................................................................................................+..................................*..................

C:\jar\qt314\d1.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	5.473703864772943
Encrypted:	false
SSDEEP:	24:zcuL2SP6lTXpBll/TRcSs/o0ffyRLDTRs1zuvkU06XWDiHx9ayQqUi4tWC03:zcuLDqFl/9og0nyRG2kaXWDiveqAR03
MD5:	AC6A6F044C493C9F99B81CEDA47B0D46
SHA1:	0285F31D88F9253129B34C3A939888BC940DEFDD
SHA-256:	0966354D74722F551248FCC430C3B79905C5585787DD032DA75BD6BA17B24FE5
SHA-512:	4E51DDAE9035D677A0B5C86B9729E27073C23A0CCD4ED52A480AA45647ABAD1E3B063D13599D2E5141BB03E0DDC79FA9471B17433554A2B4B67B4678F30AC7E2
Malicious:	false
Preview:	.......2.h...qt314/d1......java/lang/Thread......d1.java...a...Lqt314/bN;...b...I...<init>...(Lqt314/bN;I)V.......................()V.............<clinit>...llllIIIlIII...(I)Z...llllIIIIlll...(II)Z...run...java/lang/Exception......qt314/aF......c...Z.............java/awt/Rectangle..!...java/awt/Toolkit..#...getDefaultToolkit...()Ljava/awt/Toolkit;..%.&..$.'...getScreenSize...()Ljava/awt/Dimension;..)...$.+...(Ljava/awt/Dimension;)V....-..".....getHeight...()D..0.1..".2...getWidth..4.1..".5...java/util/Random..7..8.....llllIIIIllI..:......;...qt314/c1..=...Ljava/awt/Robot;....?..>.@...nextInt...(I)I..B.C..8.D...java/awt/Robot..F...mouseMove...(II)V..H.I..G.J............sleep...(J)V..N.O....P.....R...java/lang/String..T...length...()I..V.W..U.X... ..Z... ..\.........^.........`...printStackTrace..b......c...Code...StackMapTable...SourceFile. ...................................e............+........................e..........................e...!.......................f.......@.....

C:\jar\qt314\dA.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	6326
Entropy (8bit):	5.934592840945962
Encrypted:	false
SSDEEP:	192:VYvFp5By9BMMDlZClu2aUbbzFXApifPHwUa:KFK7yTPsifPQ3
MD5:	D3BAE4A99AA454929E59CE890CAE8C98
SHA1:	A5B6FA1419ABC06B5D146D01E1EC3E800F636504
SHA-256:	DDD073E0786CBDEE820BE757B404E33EDB2F9C6BF76C8BB410C143C01E01AF71
SHA-512:	9185355365A191482849D1E6052792E5AFF321EF33BCBFEF15F5FC70241BA7F6BD5581ED2E563DA4D65C69E6B6461B39428EE81685462484ED50400F6577B61B
Malicious:	false
Preview:	.......2.E...qt314/dA......java/lang/Thread......dA.java...z...[Ljava/lang/String;...llIIlllIII...lIIIIIIlIlll...(I)Z...lIIIIIIlIllI..'(Ljava/lang/Object;Ljava/lang/Object;)Z...lIIIIIIllIIl...(Ljava/lang/Object;)Z...lIIIIIIllIll...lIIIIIIIIlll...()V...java/lang/String................Sw==......kXNdd......lIIIIIIIIlII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;.............tWedCjx0GJ4=......PqWEv.. ...lIIIIIIIIlIl.."......#...J4Qh2mPNXxU=..%...cVXwx..'...lIIIIIIIIllI..)......*...NQ==..,...nQJma......wG+RTE2JiQ8=..0...JBXya..2...Gq7upq4JXO0=..4...IhceB..6...QRrZ34HlJjg=..8...CPVrF..:...Hjto5dyEeBs=..<...fvaNv..>...Q9o5g2TJLrAR434P4Jp7gg==..@...HaYbj..B...dFEoPThzUSs=..D...npHrX..F...G8GqoFVVaTg=..H...SbVtM..J...cUQWcTFTRA==..L...PnipH..N...java/lang/Exception..P...javax/crypto/spec/SecretKeySpec..R...MD5..T...java/security/MessageDigest..V...getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;..X.Y..W.Z..!java/nio/charset/StandardCharsets..\...UTF_8...Ljava/nio/c

C:\jar\qt314\dI.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	568
Entropy (8bit):	5.111768914250029
Encrypted:	false
SSDEEP:	12:1RfxYyNsTOXP675yu7+FJQ7MccnxFRUO1zkd4Cqkwg1OcFT9pw9:1Z2yNsKXP675yOvCxFqO1zurqxg19pm
MD5:	531DB4FE831FF64BD2108783DE71129D
SHA1:	7C13E37A17E571671A06FA3B2A2F8FEE2C464B6D
SHA-256:	ED1D7C4CC1F1F60642BBDBF3277A80666055AE4645FDCD5A28EB0516AC7BB364
SHA-512:	2C6E53EA73770C8E6CFFCB6BEA1A50A9D28BFA4DB290C41853102CD878F85B0FFDE3F9A4AFF0721556B6BE80A17E099C9E9E7FF0625A9A464A7A0DA5BC491D83
Malicious:	false
Preview:	.......2.2...qt314/dI......java/lang/Object......java/lang/Runnable......dI.java...a...I...<clinit>...()V...<init>...(I)V.......................run...java/lang/Exception......qt314/f......Z......................java/lang/Thread......sleep...(J)V......... ....."...java/lang/String..$...length...()I..&.'..%.(... .....printStackTrace..,......-...Code...StackMapTable...SourceFile.!............................./........................../................................./...P......./...........i..!.#..)W.+..)t.+..)....L+...............%.....0......e.......1......

C:\jar\qt314\dO.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	4119
Entropy (8bit):	5.788443643324664
Encrypted:	false
SSDEEP:	96:Y7EXeLdDiR5pSsCisbul378jDjtkQ75YxOh284j0mIW:YEkifpSsChbulrODj6UYxOgbqW
MD5:	1776C6DB5938001997C81F72362592C8
SHA1:	E2D8DD1A592AE39C6E6841AC0F6F118248470FB9
SHA-256:	626971474D38166A82F9514F27EA89FA1248573D43493AB90AF9A089B0425129
SHA-512:	02D9C3C7E3A6F916F8657B3AA3D02236898BC6527ECC3214DF551647ED888AA85365B7FCC677E56330FB105B2C60B19D137D667F073BE712310C2047AED78FD9
Malicious:	false
Preview:	.......2.....qt314/dO......java/lang/Thread......dO.java...z...Ljava/lang/String;...llIlIllllI...[Ljava/lang/String;...d...a...b...Z...c...lIIIlIIIIlIl..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/lang/Exception......javax/crypto/spec/SecretKeySpec......MD5......java/security/MessageDigest......getInstance..1(Ljava/lang/String;)Ljava/security/MessageDigest;............!java/nio/charset/StandardCharsets......UTF_8...Ljava/nio/charset/Charset;.... ....!...java/lang/String..#...getBytes...(Ljava/nio/charset/Charset;)[B..%.&..$.'...digest...([B)[B..).....+...java/util/Arrays..-...copyOf...([BI)[B../.0....1...DES..3...<init>...([BLjava/lang/String;)V..5.6....7...javax/crypto/Cipher..9..)(Ljava/lang/String;)Ljavax/crypto/Cipher;....;..:.<...init...(ILjava/security/Key;)V..>.?..:.@...java/util/Base64..B...getDecoder...()Ljava/util/Base64$Decoder;..D.E..C.F...java/util/Base64$Decoder..H...decode..J...I.K...doFinal..M.*..:.N...([BLjava/nio/charset/Charset;)V..5.P..$.Q...p

C:\jar\qt314\db.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 45.3
Category:	dropped
Size (bytes):	84814
Entropy (8bit):	6.689861733882487
Encrypted:	false
SSDEEP:	1536:YJI254yAsZsOMOEt70UsWhRxQVwykHNmVb+ItAdXf75RZP/u/edZpt0Eo:O4yXZZMOEt70PWhRxYw/WaIts5RkejDK
MD5:	1579D4DF22FBD1A66AEC7820E5D61768
SHA1:	4BAFFB948D1A88C0F4800F87512FB75693363FCB
SHA-256:	46D860B73ED830000F9C69AFB27EE62D5127DF8EF3B6B1F008EA26D32C9AD751
SHA-512:	048EE807D6AC7E8CEF8005A21051C9419B07DD85F4F515C1F14C35AEDD17268EEC0D7848D054DC4BDF352B09C798EECDC0C1CDA239CB09F8BAE9980481B4240B
Malicious:	false
Preview:	.......-.....qt314/db......java/lang/Object......c...Ljava/util/Hashtable;...h...j...Ljava/lang/String;...lIlllIIIlI...[Ljava/lang/String;...b...Ljava/security/MessageDigest;...f...d...x...e...Z...a...writer...Ljava/io/PrintWriter;...g...z...i..5(Ljava/util/Hashtable;Ljava/security/MessageDigest;)V.........java/lang/String......length...()I......... ...java/math/BigInteger..".........$...<init>...(Ljava/lang/String;I)V..&.'..#.(...java/util/Hashtable..*...put..8(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;..,.-..+.....lllIlIlIIII...(I)Z...lllIlIIlIIl...(II)Z..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;..$java/io/UnsupportedEncodingException..5.........7...java/security/MessageDigest..9...reset...()V..;.<..:.=...java/lang/StringBuffer..?...valueOf..&(Ljava/lang/Object;)Ljava/lang/String;..A.B....C...(Ljava/lang/String;)V..&.E..@.F.........H...append..,(Ljava/lang/String;)Ljava/lang/StringBuffer;..J.K..@.L...toString...()Ljava/lang/String;..N.O..@.P.........R...g

C:\jar\qt314\de.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	8239
Entropy (8bit):	6.048166193295609
Encrypted:	false
SSDEEP:	96:FAbPtVLnHAEnDe0IWcqFRe7SKlGHdPhVEIIC/hRPHqVl1SASt1WBzTNkCJnBjCPR:MjTHFDe0e9imsCVl1fStQT2Andi
MD5:	6198350C39C488335DC6321237BF311A
SHA1:	D936A069A28FF4B6D25B3FFB8DBE71572B0C2AC7
SHA-256:	280C14598094ACD53BEC112403BB2D80354CA487E092E06E687EA2FAA6735E25
SHA-512:	5EE128D7B946F91E85DAD4F51FD7BF9AE62CBD1B83FFB951163C8ECA3B4BF76EE6CB612A4C476EC12C4CBE0ACF258BD178485DD26E67214DD5122DF3685EFFCB
Malicious:	false
Preview:	.......2.....qt314/dE......javax/swing/JFrame......dE.java...d...Ljavax/swing/JTextField;...c...Ljavax/swing/JButton;...z...[Ljava/lang/String;...lllIlIIIIl...b...Ljavax/swing/JTextPane;...a...Ljavax/swing/JPanel;...lIIlIlIlllIl...()V...java/lang/String................HnoWlFQjqJU=......uQeJg......lIIlIlIllIlI..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...................GbOxp..!...lIIlIlIllIll..#......$...fS16..&...RXaWM..(...PBhUtDmjOWM=..*...egIGz..,...lIIlIlIlllII........./...FyEGMQ==..1...FRScv..3...eIPelcQrqk0=..5...eEyma..7...<init>...java/lang/Exception..:...qt314/cd..<...e...I..>.?..=.@..9......B...javax/swing/UIManager..D...getSystemLookAndFeelClassName...()Ljava/lang/String;..F.G..E.H...setLookAndFeel...(Ljava/lang/String;)V..J.K..E.L...length...()I..N.O....P... ..R...printStackTrace..T....;.U...setAlwaysOnTop...(Z)V..W.X....Y...setResizable..[.X....\.........^...setTitle..`.K....a...setDefaultCloseOperation...(I)V..c.d....e...setBounds...(IIII)V..g.h....i...

C:\jar\qt314\df.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	2382
Entropy (8bit):	5.500115932824813
Encrypted:	false
SSDEEP:	48:sL0Rdukss8ScqM/sZglzDjKGVHQZ969x1R+nUIw/46dRIx6NB:zRJj8S5bZYa69x/xIwwWSxI
MD5:	FD780ADFA9467E12E459EB99B3349742
SHA1:	74CB06B27F767E680B401F91CE898C63955DA451
SHA-256:	A5AF2EFC25C6A11867D1800FEA8EA2F79E31A3AB5DBD6F8628B4AC4974547DDE
SHA-512:	2B79346B3AAB33754E26D30F67564E530456E68F9352BB2AA6954BF1E6EA250C7991A603A265F64B5A95EE1661EEA5E8D8D45D39688A6BD178A56D9BE349909E
Malicious:	false
Preview:	.......2.....qt314/df......java/lang/Object......df.java...b...I...a...Z...c...lllllIlIIII...(JJ)I...<clinit>...()V.............lllllIlIIlI...(II)Z...<init>.......................lllllIlIIll...(Ljava/lang/Object;)Z...lllllIlIlIl...(I)Z...lllllIlIIIl...lllllIlIlII..a(Ljava/io/File;Ljava/net/Socket;Ljava/io/DataInputStream;Ljava/io/DataOutputStream;Lqt314/cW;[B)V...java/lang/Exception......java/io/FileOutputStream..!...(Ljava/io/File;)V....#..".$...java/io/DataInputStream..&...readLong...()J..(.)..'.*.....,...java/lang/String......length...()I..0.1../.2... ..4...readFully...([B)V..6.7..'.8...write..:.7..".;.........=...qt314/cW..?...(JJJ)V....A..@.B...readInt..D.1..'.E.........G...close..I....".J...java/io/File..L...java/net/Socket..N...java/io/DataOutputStream..P...[B..R..a(Ljava/io/File;Ljava/net/Socket;Ljava/io/DataOutputStream;Ljava/io/DataInputStream;Lqt314/cW;[B)V.........U...getSoTimeout..W.1..O.X...setSoTimeout...(I)V..Z.[..O.\...java/io/FileInputStream..^.._.$..0.)..M.a...write

C:\jar\qt314\dt.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.4946968938704615
Encrypted:	false
SSDEEP:	3:Dblla30QkvP6jQCK8PoLabHezsg91YL8KQXXRYHJllln3l91/yll/l1lgkY:SExXSRPgaqzsg9mbQ+LIlXvzY
MD5:	8E54E5802125BF3A0F14747D93A9A8C3
SHA1:	3C47C819F42B75254548E9481A1BFBC8B147FF91
SHA-256:	D24C947F58E96E9BB5E9E6713CEB3A811D6AF480F13A19C2FE914F00C5F43EA0
SHA-512:	52CC3B16CBF34079A65881CC306902FBD5E25427649F68766E0E86F8BB587B423A0048F1D7465E6863CAB0D4A6E9B48A9EFEB675AED7F978B3EF3706DD4E32EF
Malicious:	false
Preview:	.......2.....qt314/dt......java/lang/Object......dt.java...<clinit>...()V...a...(JJI)V...Code...SourceFile.........................................................

C:\jar\qt314\dw.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	6500
Entropy (8bit):	5.983600284263771
Encrypted:	false
SSDEEP:	192:EBah0taOyQhQljn/iC8m5Qvuw6F/a3GnXzd52PkEWoop:dxVn/13CB6F+yx52PkEWVp
MD5:	773AE9C06A84AA9A82A7B1960EBC2A53
SHA1:	885E66A4EA9CCD64E6EAEB52795F2EC14EE85140
SHA-256:	A8A3BD5D2A3299CD849F06535AB60F9C546D33DDF8DCCDE53C7938BF0C6CA648
SHA-512:	E8A347D8443B54A5E3F18FD8B9F142D18FBC04A5FD2D6D30170584D23D47D98D9A05DE2ACF81F9001B6050B86088F5E706BED597CA424739B67BE330476E597F
Malicious:	false
Preview:	.......2.W...qt314/dw......java/lang/Enum......dw.java...SAMPLE_RATE...I...b...[Lqt314/dw;...D4...Lqt314/dw;...C4$...A4$...A4...REST...E4...F4$...a...[B...llIlllIlIl...[Ljava/lang/String;...B4...F4...C4...D4$...G4...SECONDS...z...A5...G4$...lIIIllIlIIll...(II)Z...play..2(Ljavax/sound/sampled/SourceDataLine;Lqt314/dw;I)V...java/lang/Math..#...min...(II)I..%.&..$.'...data...()[B..).*....+.."javax/sound/sampled/SourceDataLine..-...write...([BII)I../.0....1.....3...java/lang/String..5...length...()I..7.8..6.9...lIIIllIIIlII..8(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;...java/util/Base64..=...getDecoder...()Ljava/util/Base64$Decoder;..?.@..>.A..!java/nio/charset/StandardCharsets..C...UTF_8...Ljava/nio/charset/Charset;..E.F..D.G...getBytes...(Ljava/nio/charset/Charset;)[B..I.J..6.K...java/util/Base64$Decoder..M...decode...([B)[B..O.P..N.Q...<init>...([BLjava/nio/charset/Charset;)V..S.T..6.U...java/lang/StringBuilder..W...()V..S.Y..X.Z...toCharArray...()[C..\.]..6.^...lIIIllIlIl

C:\jar\qt314\e.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	504
Entropy (8bit):	5.0360257683368985
Encrypted:	false
SSDEEP:	6:K4IgUUhzqzsOv1o6kdWnXM3FdOjXMPmJIPN9Lkiw04TReOv0S/l9Ali+lEOlol8N:K4g9v1tDM3FSMuKbLkit4teOfd2lolDI
MD5:	52AE8A57B29EA1AC85BDD3CD5F644FC1
SHA1:	B2E82BFCD00409B387086B027CE95746121D00A3
SHA-256:	65A8FC7780D3654876C163DDD3CBB58974905ECCF1ADA1AF2C8CCA98DDAF3129
SHA-512:	C8B3574B2E4DBC8E1EB7A4BF4E367C921E053241DF134A3F5CC6AC59CFCFCFCDAC093E72E42233DEA3E28F7B1EE20BB223FF818ECF9450476A0D0CA78EC8FF1A
Malicious:	false
Preview:	.......2.$...qt314/E......qt314/u......E.java...<clinit>...()V...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/c1......b...()Ljava/lang/String;.............qt314/cz......(Ljava/lang/String;)[B.............java/io/DataOutputStream......write...([B)V.............<init>.............()B...Code...Exceptions...SourceFile.!...................!..........................!...............N+-............".................!............*............. ...!.....................#......

C:\jar\qt314\f.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.895678229179563
Encrypted:	false
SSDEEP:	12:ClAfD/8s/MO5yv1tpthkM3Ct4gl4ma19y+1UlIn:ClQ8sw3DjCOhQ3In
MD5:	5507F21ADE099EDCF62557C689338BD0
SHA1:	CF3E97A079E0F61C970AA1C19AB41F966F67C7C3
SHA-256:	2F8B9C96E9D820C19D78FD84A2D06B4E33F6FD30A47C550E78A2CB16386BD638
SHA-512:	F60126CF5E5AA629BC59BBECDA9D344C2C0832065E342F4CCD9FFF417158E3FE327F685AB20C6A69DAC17CAAE23F29397F07AB94B5E135424A2EE4DEC3CBBE46
Malicious:	false
Preview:	.......2.....qt314/F......qt314/u......F.java...b...Ljava/lang/String;...<clinit>...()V...a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............<init>.............Code...Exceptions...SourceFile.!................................................................................................,................................................*+..................

C:\jar\qt314\g.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.895772685116282
Encrypted:	false
SSDEEP:	12:ClARt/MOLSMnGTv1tkV3N1t4gl42K0laywlt41on:Cls/y3kr1RKc5wYon
MD5:	F229E52D8F3E57B9B36CE00D6E5A7613
SHA1:	EE19A814037CA326028B5FF07FE081BC04581ACA
SHA-256:	60D2F432577F8B49700A8896EACA3BCB20DEF7B1C4AF76812479568D73E4231F
SHA-512:	2A0C6174CBCF542141A84271B0B74D421E46E73D3BF50BF08DD3AF5E94EB8E0C946B67D927B087C998ECB2E7F9652F5A7FC7B662EFA420D25119E16BBACA0B71
Malicious:	false
Preview:	.......2.....qt314/G......qt314/u......G.java...b...Ljava/lang/String;...a...()B...<init>...(Ljava/lang/String;)V...()V......................'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/cS................<clinit>...Code...Exceptions...SourceFile.!........................................................................+..............................,*............................................................

C:\jar\qt314\h.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.903097995495146
Encrypted:	false
SSDEEP:	12:ClA//MONSMnbv1tZ541t4gl4EO/4yb/zsh1on:CloBz3ZW1/O//brsjon
MD5:	BC377881DA3A0C0FDF2D2EA26751DFA7
SHA1:	3A429EAAF10BDCF4D377EE8AF6C133D0FD25B2C4
SHA-256:	25A38FECE7C470267CAA74FEA1B5F69C58B7B1DBC0028D5A318247079907AF08
SHA-512:	0C61C1BEE25FF671C30283607A7E846A31DCE322535A6878338C524530165ED4A9535451419A222F6D3A473B1E35CB5A982A40F2EF3ECC6FAD816624B12D6AFB
Malicious:	false
Preview:	.......2.....qt314/H......qt314/u......H.java...b...Ljava/lang/String;...<init>...(Ljava/lang/String;)V...()V.......................a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/cS................()B...<clinit>...Code...Exceptions...SourceFile.!...........................................+..............................,*.........................................................................................

C:\jar\qt314\i.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.903097995495146
Encrypted:	false
SSDEEP:	12:ClApl/MOOv1tpM3mSK0t4glRy2zlvJW1cdn:ClUa3z90SETCcdn
MD5:	DAA85AF4CFEBF5AEA79E6FFA0D36AF39
SHA1:	7D621A329245B1C85BC66E038B3B5E2E9FE3E060
SHA-256:	7DF99C238C9EC2A3B8C65034BB1B57B9B197D1A0526A2BB46DD3E2218D3B1190
SHA-512:	6A1C37B46341E9D986E0FF102292613CE752D6492BF1D177DB2E60FB349DF095B4B30194252DF119C12C2DC14F30F58A04C345295ED663426DDA79C8D6081648
Malicious:	false
Preview:	.......2.....qt314/I......qt314/u......I.java...b...Ljava/lang/String;...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............<init>...()V.............<clinit>...()B...Code...Exceptions...SourceFile.!........................................,................................................*+..........................................................................

C:\jar\qt314\j.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.141008841744387
Encrypted:	false
SSDEEP:	12:+lA4iv1tv8tTegsvcp8clWi3YKt4m3g8nXhVy818rvloZcvn:aZa3UZRpGKh3PxH8r9Fvn
MD5:	46DE48E6C0E5B93EB950DF666FDF2678
SHA1:	5F558E8DF1AB17DF3CC74CF3F414C477020F14CF
SHA-256:	94F3B83276B0541463E593370B0305ADBC4C260DCDEE9816093DC0E3159C8378
SHA-512:	00D8A66F6D011BBEC7D1B8E95C13AEA0E8A471C2601432A6CA3D57E264D374BF578F54B793CEB66A516C96AC190360121A99EE48ECC9CEB0E09B171BF21F0A68
Malicious:	false
Preview:	.......2.(...qt314/J......qt314/u......J.java...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......java/lang/Runtime......getRuntime...()Ljava/lang/Runtime;.............totalMemory...()J.............freeMemory......................java/io/DataOutputStream......writeLong...(J)V.............<clinit>...()V...<init>..!. ...."...()B...Code...Exceptions...SourceFile.!...................%...>.......2...N-...-...e...m...m7.-......m...m7.+.....+...........&............. ...%....................!. ...%............*..#..........$...%......................'......

C:\jar\qt314\k.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.899370039616131
Encrypted:	false
SSDEEP:	12:ClA9Z/MO59v1tCEMrCt4gl4ma1iym//WIa7l8gzIn:Cl4Z734COhRGGYn
MD5:	A7C128B114C336C7329881ACA20A0A69
SHA1:	04BFA1857398A4DABA36E239747D33C6C44759B0
SHA-256:	473EDEE3E46E262632338BADBD18459BD771805DC97BE81F4B73C8D6FC647837
SHA-512:	FBBE2EC0FCBFCF683E0C3FD27AB447B7E98CBAA625D0AB2483D979DDB24B7FBD90FE6C65B14EAF30989A15CA4780C16BCE87055D8CF88181D047C4A7AC77E9DE
Malicious:	false
Preview:	.......2.....qt314/K......qt314/u......K.java...b...Ljava/lang/String;...<clinit>...()V...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............()B...<init>.............Code...Exceptions...SourceFile.!...................................................................,.............................................................................*+..................

C:\jar\qt314\l.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.885039304750224
Encrypted:	false
SSDEEP:	12:ClAysT/MOLSMnGTv1tkV3N1t4gl4HS0laywlt41on:Clg/y3kr1nc5wYon
MD5:	6E67D3611CE1728F3239644BA2DC1263
SHA1:	8A21699A56D2116FD8BA40131584FD465A1BAB08
SHA-256:	656B022061000CDD19392826B7BB12E46022CC4038225B77359F5A9C1DD4D3B8
SHA-512:	B6DAA4EFB8E9B1D1A736BE280AB55D9DE5963A22C90257C31D766B8F4AEE26FD472B4224B12996CA26F9BDBC857B31BD0159E66FCEF43272931630F4639ABD18
Malicious:	false
Preview:	.......2.....qt314/L......qt314/u......L.java...b...Ljava/lang/String;...a...()B...<init>...(Ljava/lang/String;)V...()V......................'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/cS................<clinit>...Code...Exceptions...SourceFile.!........................................................................+..............................,*............................................................

C:\jar\qt314\r.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.006362183194083
Encrypted:	false
SSDEEP:	12:WZaDL8OQ/MOrYkMaMl+esQv1tzMtt4Fl/JdviEnJWqXl9g:h/8/ofYY3IslxRiEJy
MD5:	12B754D23407D3530384667BF1E76582
SHA1:	8D26074886B27A6741BE2F34933D2C15694DAA8D
SHA-256:	E89CEF02C28F31A137C660562E54BFBA181E3B8875EA950B52C920198590A9E6
SHA-512:	066D4B1755CABB663040BF6A2D7A78C92BDB218C864722E26B1C7EA7B2C7E7512CBFAB45148E300E67E102A98CF234FB761ED2240D8774E2CE41CABC07C00534
Malicious:	false
Preview:	.......2. ...qt314/R......qt314/u......R.java...c...Ljava/lang/String;...b...<clinit>...()V...<init>..'(Ljava/lang/String;Ljava/lang/String;)V.................................a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......qt314/cS......(Ljava/lang/String;)V.............Code...Exceptions...SourceFile.!..............................................................................+...,............................... ..................!........,........,*.................................

C:\jar\qt314\u.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.907612668181375
Encrypted:	false
SSDEEP:	12:ClAFx/MOOv1tpM3PYet4glRy2Ama1nfqn:ClUa3LeSVhfqn
MD5:	147B15BCF33D5426EA6064BBE32A042A
SHA1:	F2B433EACAAA0C2FD0244EF028159B61FD36BE3B
SHA-256:	5D684CDA44CE89D12847DF0B85593358CC465838E9B1D41B9B865BDCFE770B99
SHA-512:	21EBF5856F1AC40C9763CF9D3A8D510F17DB1260A789D983C698EDEC6DFA63443131205E765745F803452F92832319D841FE0D2787D83A5712C552D6CDA127A1
Malicious:	false
Preview:	.......2.....qt314/U......qt314/u......U.java...b...Ljava/lang/String;...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............()B...<clinit>...()V...<init>.............Code...Exceptions...SourceFile.!........................................,..............................................#.........................................................*+..................

C:\jar\qt314\v.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.554892155836689
Encrypted:	false
SSDEEP:	6:hAwzIYszG3klSXBv1o6y0w04TxlFlozUKlZlXvUluTlMEWlkdFWv6:nBSBSxv1t5t4dlFlo4KlZlXUupFHD
MD5:	22E9B8071CAD79F5547C3A92B5A55903
SHA1:	4A07D5A385D0CCCF7B172DBE35D66BF010E1B70D
SHA-256:	C950BD18DF736B99DC39F2518B407A7CA63848C761713E57A452E10C93EB0DA6
SHA-512:	D4580E4CB65CF413CC147B14EC7E752025C808B76D5A7723DFD87524BF2222F7B30462F18185BED5C221121B05D394E05D2AE937B8EA0CFBED2C17D1CF42C3D9
Malicious:	false
Preview:	.......2.....qt314/V......qt314/u......V.java...<init>...()V.............<clinit>...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception......()B...Code...Exceptions...SourceFile.!................................*...............................................................................................$...............

C:\jar\qt314\w.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	624
Entropy (8bit):	5.116721602794812
Encrypted:	false
SSDEEP:	12:sWh9/MOccs5yv1tjMoEV9oUSheBDeNBKMaMkSDt4SdOphxlKF6:sWzYk3KPBDSDzgpIs
MD5:	09E824A567C87DA86B4B127FF2243ABA
SHA1:	A21816812B68DB6FA6720287D0FECC67086F9C2B
SHA-256:	463B22C78DC6687F12FBA6D541BBE5A19741CC8977ACD9824593B74F064261B2
SHA-512:	9EF4DD2D3E628F451245BBFAD16EC6E6E457985CEF987ECBEBF402BC0C160BB97CEBEEB914717C0AB9822C5CF2C5F7791EFC68F82D11F9DBF8EED33FD8A6B076
Malicious:	false
Preview:	.......2....qt314/W......qt314/u......W.java...b...Ljava/lang/String;...c...Z...d...<clinit>...()V...a...()B..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.................................java/io/DataOutputStream......writeBoolean...(Z)V.... ....!...<init>..((Ljava/lang/String;Ljava/lang/String;Z)V..#......%...Code...Exceptions...SourceFile.!...........................................'..........................'.............%..............'...)........,........,........+....."......(...........#.$...'... ..........&+...,...............)......

C:\jar\qt314\x.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.907612668181375
Encrypted:	false
SSDEEP:	12:ClAGQT/MOOv1tpM3PYet4glRy2/ma1nfqn:Cl/Aa3LeSehfqn
MD5:	882BA4E06D3F3F9AF5FB69037D82DED2
SHA1:	A8E5BE0B994A637A56E6D22A4792FBEB1F027A23
SHA-256:	A006D096935B39B48220902CB0D5D7FA31ADC0916199942FFC13B700F316C469
SHA-512:	3AF25D487C898A0B0D4A6CC4EE4181CD12CFB35E7B178B7112D200B1C7BF4B67A1D87CF6B707850CEE6EC9019F0861932E6DF53954CAA3EC76DD92DADAD51109
Malicious:	false
Preview:	.......2.....qt314/X......qt314/u......X.java...b...Ljava/lang/String;...a..'(Ljava/io/DataOutputStream;Lqt314/cS;)V...java/lang/Exception................qt314/cS......(Ljava/lang/String;)V.............()B...<clinit>...()V...<init>.............Code...Exceptions...SourceFile.!........................................,..............................................&.........................................................*+..................

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.943582659776467
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	Form-8879_PDF.jar
File size:	418'816 bytes
MD5:	aab581c5eec444fec05cf4d81bb57f66
SHA1:	d503d1d22720cb62571b9d36852eb07e764e052a
SHA256:	769fc3a07c8e31ebd1c6cc9dd91b3c4870688404aa255f6d615c4e60bcd6dec4
SHA512:	06a4b8a072ef2f5d309b73cd07afea8e926a125a670cb3690435b17fb004d2b9172ed70de87b35ce94ba9da06041a0d7ead63c96e1ba21d10be03cf28daf43a4
SSDEEP:	12288:GQXtDmMkRxkOOGkOfnq/4t5zmjrbCu51RGw9Q:PtDwRxkdGkSn64t5iXbz51RGw9Q
TLSH:	D694E0673DC09065F95BA0B0440D8533A70971CC9DEA95271EBCE58FAA28D4B7B03ADF
File Content Preview:	PK..........*F................qt314/..PK........z.0Y................qt314/T.classeP.N.P.=.V..@.._...hl\|. .\|.H\....!%.E.5~........G...q.]...9s..~}.\|.8.&A..G...H.-.D.L(.....K.kB}..v.F.... ..Y1..@.....twL.;.......e.%.:$T.....e..;.A....p..1K....m........w....

File Icon


Icon Hash:	d08c8e8ea2868a54

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-18T11:21:36.368425+0200	2811489	ETPRO MALWARE Java/Jacksbot Checkin (INBOUND)	1	193.142.146.64	4439	192.168.2.4	49730	TCP
2024-09-18T11:21:36.375447+0200	2811490	ETPRO MALWARE Java/Jacksbot Checkin (OUTBOUND)	1	192.168.2.4	49730	193.142.146.64	4439	TCP
2024-09-18T11:21:36.823509+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49730	193.142.146.64	4439	TCP
2024-09-18T11:21:36.850053+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49730	193.142.146.64	4439	TCP
2024-09-18T11:21:48.539976+0200	2811489	ETPRO MALWARE Java/Jacksbot Checkin (INBOUND)	1	193.142.146.64	4439	192.168.2.4	49731	TCP
2024-09-18T11:21:48.546620+0200	2811490	ETPRO MALWARE Java/Jacksbot Checkin (OUTBOUND)	1	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:49.039314+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:49.046827+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:49.115317+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:49.122246+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49731	193.142.146.64	4439	TCP
2024-09-18T11:21:56.728726+0200	2811489	ETPRO MALWARE Java/Jacksbot Checkin (INBOUND)	1	193.142.146.64	4439	192.168.2.4	49738	TCP
2024-09-18T11:21:56.736001+0200	2811490	ETPRO MALWARE Java/Jacksbot Checkin (OUTBOUND)	1	192.168.2.4	49738	193.142.146.64	4439	TCP
2024-09-18T11:21:57.173907+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49738	193.142.146.64	4439	TCP
2024-09-18T11:21:57.178949+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49738	193.142.146.64	4439	TCP
2024-09-18T11:21:57.254712+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49738	193.142.146.64	4439	TCP
2024-09-18T11:21:57.289129+0200	2811491	ETPRO MALWARE Java/Jacksbot CnC Beacon	1	192.168.2.4	49738	193.142.146.64	4439	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 11:21:35.697062016 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:35.703346968 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:35.703433037 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.280842066 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.321343899 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.368424892 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.370526075 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.375291109 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.375447035 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.380213022 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.671508074 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.726877928 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.803904057 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.818598986 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.823400021 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.823508978 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.828293085 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.828620911 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.833440065 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.834207058 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.839082956 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.844814062 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.849730015 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.850053072 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.854913950 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.858907938 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.863904953 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.864022017 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.868849039 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.869973898 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.874828100 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.875020981 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.879928112 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.899344921 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.904320955 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.904537916 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.909356117 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:36.909475088 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:36.914741993 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:38.681350946 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:38.686253071 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:38.688128948 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:38.694024086 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:38.694309950 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:38.699148893 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:39.191113949 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:39.242597103 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:40.696669102 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:40.701586008 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:40.701726913 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:40.706639051 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:41.691076040 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:41.691248894 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:41.696125984 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:44.191735029 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:44.191893101 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:44.196679115 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:46.692133904 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:46.692331076 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:46.697220087 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:47.851041079 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:47.856107950 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:47.856188059 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:48.447531939 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:48.498852968 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:48.539975882 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:48.541481972 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:48.546569109 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:48.546619892 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:48.551527977 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:48.845364094 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:48.889375925 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:48.979767084 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.031076908 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.034296989 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.039205074 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.039314032 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.044967890 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.046827078 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.051711082 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.053514957 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.058376074 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.058641911 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.063513994 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.064637899 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.069418907 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.110363960 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.115227938 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.115317106 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.120126009 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.122246027 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.127039909 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.127213001 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.132020950 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.132608891 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.137407064 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.138515949 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.143598080 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.143693924 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.148520947 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.149053097 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.153975010 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.154051065 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.158912897 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.192109108 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:49.192253113 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:49.197079897 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:51.692696095 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:51.696645975 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:51.709255934 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:51.714164019 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:51.748770952 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:53.126527071 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:53.131566048 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:53.131663084 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:53.136538982 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:54.192825079 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:54.193017960 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:54.196443081 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:54.197771072 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:54.248749971 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:56.068439960 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:56.073755026 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.074580908 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:56.642076015 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.683213949 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:56.693499088 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.693638086 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:56.697565079 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.698451042 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.728725910 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.730444908 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:56.735294104 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.736001015 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:56.740756989 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:56.745702982 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.029306889 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.073829889 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.158663988 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.168653965 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.173496008 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.173907042 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.178668976 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.178949118 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.183742046 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.185765982 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.190574884 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.247621059 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.254560947 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.254712105 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.259565115 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.261533976 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.266354084 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.273010015 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.277847052 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.281661034 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.286624908 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.289129019 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.297950983 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:57.300957918 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:57.305999041 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:58.064515114 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:58.069725990 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:58.069917917 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:58.080137014 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:59.192781925 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:59.194185019 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:59.194619894 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:59.197973967 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:59.198138952 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:21:59.199496984 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:59.203120947 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:21:59.245820999 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:01.673692942 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:01.678766012 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:01.678883076 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:01.683713913 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:01.692728043 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:01.694432974 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:01.694559097 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:01.698276997 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:01.698419094 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:01.699368000 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:01.703253984 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:01.745713949 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:04.194349051 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:04.195382118 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:04.195549965 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:04.199321985 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:04.199479103 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:04.200404882 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:04.204457998 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:04.245743036 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:06.095520020 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:06.251627922 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:06.251748085 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:06.257800102 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:06.693932056 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:06.694159985 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:06.695786953 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:06.696038008 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:06.699589014 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:06.699697971 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:06.699721098 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:06.700895071 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:06.704804897 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:09.194741011 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:09.195070028 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:09.196263075 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:09.196363926 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:09.200006962 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:09.200201035 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:09.200392008 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:09.201437950 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:09.205238104 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:11.699569941 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:11.699909925 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:11.700412989 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:11.700529099 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:11.706228018 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:11.706248045 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:11.706260920 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:11.706373930 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:11.711246967 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:14.198847055 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:14.199135065 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:14.200459003 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:14.200555086 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:14.202888966 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:14.202991962 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:14.204787016 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:14.207770109 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:14.209289074 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:16.696749926 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:16.696921110 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:16.698156118 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:16.698256016 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:16.701911926 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:16.701965094 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:16.702116966 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:16.703068972 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:16.707062006 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:19.197129965 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:19.197381973 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:19.198896885 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:19.199065924 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:19.202272892 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:19.202343941 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:19.202461004 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:19.203907013 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:19.207367897 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:21.697926998 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:21.698112965 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:21.699836016 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:21.699934959 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:21.703560114 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:21.703588963 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:21.703687906 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:21.704780102 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:21.708663940 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:24.198767900 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:24.198975086 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:24.200284958 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:24.200387001 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:24.203829050 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:24.204230070 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:24.204350948 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:24.205137014 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:24.209284067 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:26.699816942 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:26.701446056 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:26.705280066 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:26.706341028 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:26.706489086 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:26.706609964 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:26.711129904 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:26.711282015 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:26.711321115 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:29.199934006 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:29.201524973 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:29.202779055 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:29.202831984 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:29.205291986 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:29.206259012 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:29.207726002 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:29.207755089 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:29.211253881 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:31.700272083 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:31.700660944 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:31.701875925 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:31.702095985 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:31.705575943 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:31.705732107 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:31.705841064 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:31.706876040 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:31.710669041 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:34.200932026 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:34.201098919 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:34.202328920 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:34.202426910 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:34.206005096 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:34.206254959 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:34.206382036 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:34.207235098 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:34.211257935 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:36.701522112 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:36.701680899 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:36.703087091 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:36.703202009 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:36.706732988 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:36.706896067 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:36.707019091 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:36.708022118 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:36.711879969 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:39.202354908 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:39.202527046 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:39.203809977 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:39.203933001 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:39.207362890 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:39.207588911 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:39.207737923 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:39.208969116 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:39.212585926 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:41.702558994 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:41.702876091 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:41.704427004 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:41.704535961 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:41.707808018 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:41.708108902 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:41.708230019 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:41.709479094 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:41.713040113 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:44.202791929 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:44.203145981 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:44.205068111 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:44.205236912 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:44.208635092 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:44.208766937 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:44.209716082 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:44.211141109 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:44.213761091 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:46.703428984 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:46.705014944 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:46.708925962 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:46.715447903 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:46.715579033 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:46.715766907 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:46.720329046 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:46.720349073 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:46.720577002 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:49.204348087 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:49.204663038 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:49.205789089 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:49.205888033 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:49.209508896 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:49.209630966 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:49.209764004 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:49.210644960 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:49.214632034 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:51.705470085 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:51.705652952 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:51.707612038 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:51.707778931 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:51.711018085 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:51.711198092 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:51.712650061 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:51.714930058 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:51.718261957 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:54.206094027 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:54.206414938 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:54.207211018 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:54.207483053 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:54.211042881 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:54.211195946 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:54.211456060 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:54.212508917 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:54.216125965 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:56.706670046 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:56.706840992 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:56.708281994 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:56.708372116 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:56.713299036 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:56.713526964 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:56.713629007 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:56.714157104 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:56.719119072 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:59.207600117 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:59.207722902 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:59.209208965 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:59.209291935 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:59.212529898 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:59.212846994 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:59.212935925 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:22:59.214082956 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:22:59.217695951 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:01.708163023 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:01.708307981 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:01.709801912 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:01.709913969 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:01.713104010 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:01.713604927 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:01.713702917 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:01.714688063 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:01.718640089 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:04.400037050 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:04.400053024 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:04.400060892 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:04.400340080 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:04.400420904 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:04.400427103 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:04.405100107 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:04.405214071 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:04.405222893 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:06.709489107 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:06.709681034 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:06.710964918 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:06.711064100 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:06.714643002 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:06.714812040 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:06.714926958 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:06.716133118 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:06.720145941 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:09.210059881 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:09.210274935 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:09.211539984 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:09.211641073 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:09.215322971 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:09.215439081 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:09.215548038 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:09.216552019 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:09.220324039 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:11.710364103 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:11.710552931 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:11.712006092 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:11.712121010 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:11.717612028 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:11.717622042 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:11.717773914 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:11.718626022 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:11.724417925 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:14.211143017 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:14.211318016 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:14.212562084 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:14.212667942 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:14.216434002 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:14.216464043 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:14.216576099 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:14.217542887 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:14.221638918 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.717585087 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.717601061 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.717606068 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.717813015 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.717819929 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.717828035 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.717997074 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718003988 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718005896 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718005896 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718033075 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.718043089 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.718050957 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.718056917 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718074083 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718091965 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718095064 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718121052 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718307018 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.718316078 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.718323946 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.718347073 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718365908 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.718370914 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:17.724441051 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.724452019 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:17.724458933 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:19.212641001 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:19.212908030 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:19.214155912 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:19.214272976 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:19.217756987 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:19.218519926 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:19.218667030 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:19.219122887 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:19.223490953 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:21.713373899 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:21.714931965 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:21.715761900 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:21.715955973 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:21.718648911 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:21.720676899 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:21.720778942 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:21.720834970 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:21.725677013 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:24.317656040 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:24.317698956 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:24.317734957 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:24.320677996 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:24.320755005 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:24.320872068 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:24.325678110 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:24.325706959 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:24.325762987 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:26.714385033 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:26.714695930 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:26.716037989 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:26.716164112 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:26.719718933 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:26.719788074 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:26.719935894 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:26.720999956 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:26.724817038 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:29.215257883 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:29.215534925 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:29.216856003 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:29.216960907 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:29.220571041 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:29.220608950 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:29.220735073 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:29.221787930 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:29.225712061 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:31.715662003 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:31.715950012 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:31.717286110 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:31.717540979 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:31.721204042 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:31.721424103 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:31.721534014 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:31.723112106 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:31.728493929 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:34.219307899 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:34.219589949 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:34.220119953 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:34.220227957 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:34.223906994 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:34.224142075 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:34.226383924 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:34.227171898 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:34.231045008 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:36.717003107 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:36.717148066 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:36.718590021 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:36.718703985 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:36.721967936 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:36.722510099 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:36.722747087 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:36.723499060 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:36.727582932 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:39.217734098 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:39.218929052 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:39.219564915 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:39.220007896 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:39.223289967 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:39.224045038 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:39.224162102 CEST	49731	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:39.224797964 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:39.229182005 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:41.718791008 CEST	4439	49738	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:41.720350027 CEST	4439	49730	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:41.723958015 CEST	4439	49731	193.142.146.64	192.168.2.4
Sep 18, 2024 11:23:41.761574030 CEST	49738	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:41.761775017 CEST	49730	4439	192.168.2.4	193.142.146.64
Sep 18, 2024 11:23:41.777194977 CEST	49731	4439	192.168.2.4	193.142.146.64

Target ID:	0
Start time:	05:21:31
Start date:	18/09/2024
Path:	C:\Windows\System32\7za.exe
Wow64 process (32bit):	true
Commandline:	7za.exe x -y -oC:\jar "C:\Users\user\Desktop\Form-8879_PDF.jar"
Imagebase:	0x100000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:21:31
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:21:32
Start date:	18/09/2024
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
Wow64 process (32bit):	true
Commandline:	java.exe -jar "C:\Users\user\Desktop\Form-8879_PDF.jar" qt314.c1
Imagebase:	0x810000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:21:32
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:21:33
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x1d0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:21:34
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:21:36
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Imagebase:	0xab0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:21:36
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:21:38
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list
Imagebase:	0xab0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:21:38
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:21:45
Start date:	18/09/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar"
Imagebase:	0x7ff70f330000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:21:48
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Imagebase:	0xab0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:21:48
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:21:52
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list
Imagebase:	0xab0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:21:52
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:21:54
Start date:	18/09/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\Form-8879_PDF.jar"
Imagebase:	0xe60000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	05:21:56
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /format:list
Imagebase:	0xab0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:21:56
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:22:01
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:\\root\SecurityCenter2 path FirewallProduct get /format:list
Imagebase:	0xab0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:22:01
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 0269D8F7 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d622011201ef0ceb88bc9120301cc1e923b6e2aa51ac20986f62596825b50025
Instruction ID: b80783058f094231ca4e5ca9f23f5172f6814a83c8e98a57b82a8518e9b97272
Opcode Fuzzy Hash: d622011201ef0ceb88bc9120301cc1e923b6e2aa51ac20986f62596825b50025
Instruction Fuzzy Hash: D3A1CCB1A04641DFDF18EF64C494BA9FBB9FF49318F0881ADD91A4B381CB34A845CB91

Function 0269D8E0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f226fea92472282222946cff8451cdd3b13a3ba6c4c9872fd8dce047df1181
Instruction ID: e7fd87fceaab8a4eb1b148484f9c0288395736f406caf0ba5b523b29b8b7c669
Opcode Fuzzy Hash: 26f226fea92472282222946cff8451cdd3b13a3ba6c4c9872fd8dce047df1181
Instruction Fuzzy Hash: 8961ADB1604641DFDB18EF24C494BAAFBB9FB49714F0481ADD81A4B381CB74A851CB91

Function 0277D7A7 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002734000.00000040.00000800.00020000.00000000.sdmp, Offset: 02734000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2734000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05922ff277662288198b41a42d7854497bfa8bbb18bad25e523e08935942e005
Instruction ID: 4130a3d84d2fc00abd487d17e68cc7b6073ee6d4d606c0ac5f57848242c0c5e9
Opcode Fuzzy Hash: 05922ff277662288198b41a42d7854497bfa8bbb18bad25e523e08935942e005
Instruction Fuzzy Hash: 6931D370A09782EFEB25CF24C5597A9FBB4BF02708F0481ADC84857791DB34A558CBD2

Function 026A4DBC Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb35609eee36a857a249774af4701b892c64bd207834d66cc56efa4728f6948f
Instruction ID: 28da864086464a41394bf7493ebb8a3e6adfb172d19d396e20b9f958198bfedd
Opcode Fuzzy Hash: bb35609eee36a857a249774af4701b892c64bd207834d66cc56efa4728f6948f
Instruction Fuzzy Hash: 56218E76A00601DBDB25CF24C8A079AF7B1FB45314F28465AC91997352DBB4BC12CFC0

Function 02690672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2690000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b415306beff7c4ccbe8b47454e4a4a80dff93767198596e8e7d33aab8381c2
Instruction ID: 6c73251acd1d777b46d0e280c8281ad00dc493e937f96fd45da1d152fa4d6f3c
Opcode Fuzzy Hash: 26b415306beff7c4ccbe8b47454e4a4a80dff93767198596e8e7d33aab8381c2
Instruction Fuzzy Hash: 1B118BB2D0022ACFCF18CF48C4814ADB3B8FB98324B264529DC65A3341DB356920CB81

Function 02690722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2690000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89d1685702adc4a5b541d43cdbf5a0f8ee4379374bd06bc745fefd16649b533
Instruction ID: 2a0ac27e3ea85988b2b5bd456c4c907dc1952a6ca29900acca31ff25a96afc04
Opcode Fuzzy Hash: e89d1685702adc4a5b541d43cdbf5a0f8ee4379374bd06bc745fefd16649b533
Instruction Fuzzy Hash: 41F01576C00229DB8F14DF48C4800ADB7B1EB44228B2A8496DC283B341D732AD62CF91

Function 026A4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28955edf0a3297ccc88aa581b2f602116ba361f7167cfeb792da938f559a2a07
Instruction ID: ca77250f2dd6ec54ec31e821052dc9252406371551571fb8822f69855c1812eb
Opcode Fuzzy Hash: 28955edf0a3297ccc88aa581b2f602116ba361f7167cfeb792da938f559a2a07
Instruction Fuzzy Hash: A2F07FB5A00A06EBDB158F61C1047DAFBB4BB88718F14421AD42C57350D77874698BC0

Function 026A5346 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35d821dfee9f35f0f733798525a8ebcba698dd8c86ded3b14832423e4a3afc6
Instruction ID: 132c40cef194b7a88bb005267ca8e67ffd6536135e7e5d823f8dafbdb8509a6f
Opcode Fuzzy Hash: f35d821dfee9f35f0f733798525a8ebcba698dd8c86ded3b14832423e4a3afc6
Instruction Fuzzy Hash: 43F09BB6A00A06EBDB25CF61C1047DAFBB4BB48714F15421AC42D67350C778B469CBC0

Function 026A6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49f3b9ac0c19c427e226271efee72a3436678f026fc7dcdf23e5dd0763051e0
Instruction ID: f97e85d14c0e31043bf3007b58ea40b2e5581666bf9877677dfb7e848c3fd5e0
Opcode Fuzzy Hash: e49f3b9ac0c19c427e226271efee72a3436678f026fc7dcdf23e5dd0763051e0
Instruction Fuzzy Hash: 4AF09BB6A00A16EBDB26CF65C1147DAFBB4BB88718F14421AC42C67350D778B46ACBC0

Function 0269DA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32814e051274418939a1dae002a8f971ef6bf97835c297a14f74eabfbac45fdd
Instruction ID: 63361afd088f78827a62faa4637c329528c795394446bc8880bb49f5cee5194d
Opcode Fuzzy Hash: 32814e051274418939a1dae002a8f971ef6bf97835c297a14f74eabfbac45fdd
Instruction Fuzzy Hash: 55F0C2B6D00A0AABDB248F61C1047DAFBB8BB44714F14421AC42C63310D7787469CBC1

Function 026A49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba111aa5226a7dbf5cf60ef134fbb8c15182acc7e2a1e144a6e76067f4e6b973
Instruction ID: ec7d648d6817a23daffedd9e657ad879fbe49520dc88d8362f7d3e2860cbd835
Opcode Fuzzy Hash: ba111aa5226a7dbf5cf60ef134fbb8c15182acc7e2a1e144a6e76067f4e6b973
Instruction Fuzzy Hash: 71F0CAB6D00A06ABDB248F61C1047DAFBB8BB88718F14421AC42C67320D778B4A9CBC0

Function 0269DE6E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc97237a1d6295ac94f5c70302038d1abe9e0266d8f28b266193ecc98ace228
Instruction ID: c5ec460241e6631a90701e43da595b3f39e2b99006a14e941d47c37d93ca86ae
Opcode Fuzzy Hash: 2bc97237a1d6295ac94f5c70302038d1abe9e0266d8f28b266193ecc98ace228
Instruction Fuzzy Hash: 7CF0CAB6D00A06EBDB248F61C1047DAFBB8BB88718F14421AC42C63720C778B4A9CBC0

Function 026A3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da8d7a691d3400827454677b1c0fae58f2356f5286b775497cc43e5e24cd781
Instruction ID: a7ec9776e3f0f649edea2774fc65e01d9a90e2440aa402a67f79f37828e0ae6e
Opcode Fuzzy Hash: 2da8d7a691d3400827454677b1c0fae58f2356f5286b775497cc43e5e24cd781
Instruction Fuzzy Hash: 2DF0C2B6D00A06ABDB248F61C1047DAFBB8BB44714F14421AC42C67310D7797469CBC1

Function 026A45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e201e0bfbd4e1186459d7222b7c627260de49873f324f3a75e8a53710f9542c0
Instruction ID: 2c1654bf79c7996247e3312040b89adabf320d5f82f5c0ff06d09451c01305ca
Opcode Fuzzy Hash: e201e0bfbd4e1186459d7222b7c627260de49873f324f3a75e8a53710f9542c0
Instruction Fuzzy Hash: A2F0C2B6D00A06ABDB248F61C1047DAFBB8BB44B14F14421AC52C67310D7787469CBC0

Function 026A4DD4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002692000.00000040.00000800.00020000.00000000.sdmp, Offset: 02692000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2692000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eed93653c2a99c2b41086059b31e0edfc021b42a8671bb75a2265ac8d0dfa4b
Instruction ID: aa093ab51f8162af528c27cc9772a30b5dea67c019e6a622307652c8da118fc5
Opcode Fuzzy Hash: 8eed93653c2a99c2b41086059b31e0edfc021b42a8671bb75a2265ac8d0dfa4b
Instruction Fuzzy Hash: FAF0C2B5D00A06ABDB24CF61C10439AF7B4BB44B14F14421AC42C63310C778B465CBC1

Non-executed Functions

Function 02739DC9 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

D, xrefs: 027A91DA

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002734000.00000040.00000800.00020000.00000000.sdmp, Offset: 02734000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2734000_java.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 476f1bcab456dd0b8a5836c90bb07ddbe92776454178a0d16b0f0407f21f78ab
Instruction ID: 9006f4d17d8f39d2e52b52a3203e32bc37ecd039ff2228b8241199a0d2c7afb4
Opcode Fuzzy Hash: 476f1bcab456dd0b8a5836c90bb07ddbe92776454178a0d16b0f0407f21f78ab
Instruction Fuzzy Hash: CF71B6725146608FC766AF3CC49522EF7E2EFC4724F1B495DD5858B342DA30E842CB82

Function 0273F818 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002734000.00000040.00000800.00020000.00000000.sdmp, Offset: 02734000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2734000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd5efb8a75161eee382b65ddf3553bc1b956dde649b7d7384f6fada30e588fc3
Instruction ID: ac89050b1cb2d5ff6752a33ccdba5546e5bb26493ac53c087b2e121a0fbfd071
Opcode Fuzzy Hash: dd5efb8a75161eee382b65ddf3553bc1b956dde649b7d7384f6fada30e588fc3
Instruction Fuzzy Hash: CA517F72D047118FC312DF28C58472AF7E1BB89358F298A5DE898A7756D731E846CB82

Function 026903C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2912620462.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2690000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction ID: 9b2e5298c3b786ccb42e85dd88e799d05c79ba7bf9b1b4e6c59103ce694d4f0b
Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction Fuzzy Hash: 7521D3BA5082568FEF358F198C403D9B7E9FB59314F21482EDEC9E7710D7306A898B91

Analysis Process: javaw.exePID: 6576, Parent PID: 2580COMMON

Executed Functions

Function 029CD8F7 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5c62659d9dc77be022c7572738671d02ebfacfff43b273f944e7aaa5228f4f
Instruction ID: de4943491c53f29819fa226f1721100013d51ce54c21521343f85a64cf08cd7e
Opcode Fuzzy Hash: bd5c62659d9dc77be022c7572738671d02ebfacfff43b273f944e7aaa5228f4f
Instruction Fuzzy Hash: 31A1C0B1A04641DFDB18CF24C494BAAF7B5FF49314F2481ADD81A4B381CB34A844CFA2

Function 029CD8E0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6092a731507202aff524ed3e3004dff08a6933ad99d59dadde9b0c908203e7a
Instruction ID: 708c8f92e31ee0b043e48e3b7ee038a162a80f6b7d82844eec5bfe437f028409
Opcode Fuzzy Hash: d6092a731507202aff524ed3e3004dff08a6933ad99d59dadde9b0c908203e7a
Instruction Fuzzy Hash: 99619B75600641DFEB18CF20C494BAAFBB5FF49714F2885ADE81A4B381C774E845CBA2

Function 029C0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b415306beff7c4ccbe8b47454e4a4a80dff93767198596e8e7d33aab8381c2
Instruction ID: 5030f90778ddba64f1e4eb7e64cc690dddadaa5d1bed71420cd193b888cc1bec
Opcode Fuzzy Hash: 26b415306beff7c4ccbe8b47454e4a4a80dff93767198596e8e7d33aab8381c2
Instruction Fuzzy Hash: 8A118BB2D0022ACFCF18DF48C9815ADB3B4FB98314F664629DC69A3341D3356920CB82

Function 029D4CCD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa65429b247305f263577dd1809b8320e6824219e1f3adfa4b3a05b0735c38f4
Instruction ID: 6659e33e5d66ba4d7198a1077298bba491a6dc9e7f4a22a284c779513a6eb01b
Opcode Fuzzy Hash: fa65429b247305f263577dd1809b8320e6824219e1f3adfa4b3a05b0735c38f4
Instruction Fuzzy Hash: 8AF0DFB5A00A06EBEB15CF60C1047EAF7B8FB88708F14420AD42C53310C3787469CBD1

Function 029C0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89d1685702adc4a5b541d43cdbf5a0f8ee4379374bd06bc745fefd16649b533
Instruction ID: fb4f9c6043b8909e3545958ca59fa1cbe0fb412e84698f57f8cc5c5febc79d4f
Opcode Fuzzy Hash: e89d1685702adc4a5b541d43cdbf5a0f8ee4379374bd06bc745fefd16649b533
Instruction Fuzzy Hash: 63F0F276C00229DB8B189F48C9400ADB7B1AB44218F2A84AADC2C37241D332AD62CF92

Function 029D4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bed88a8adb277d1db3a6db7ac52e525769fb52328748b5d16cd555ec97b2b91
Instruction ID: aa47a985d80b86a1187252989db8177d52f1f938756a12bda9afb09170f05d70
Opcode Fuzzy Hash: 9bed88a8adb277d1db3a6db7ac52e525769fb52328748b5d16cd555ec97b2b91
Instruction Fuzzy Hash: 21F07FB5A00A06EBDB15CF61C1047DAFBB4BB88718F14421AD42C57350D77874698BD1

Function 029D6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be00173e198f3d790e69e571a3ccea372c40ff5662933247e6ef50f1f5e8c72
Instruction ID: 75ddada433e12aa56f695bddc14433045e7cdb618ae82fe2c324a9b388f85bc2
Opcode Fuzzy Hash: 6be00173e198f3d790e69e571a3ccea372c40ff5662933247e6ef50f1f5e8c72
Instruction Fuzzy Hash: E7F09BB6A00A16EBDB26CF65C1047CAFBB4BB88718F14421AC42C67350D778B46ACBD1

Function 029CDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914d03ebe5ee90f1f4c1a5f2b1c993fdec631088cbe9b0da6ce13adc057a7d1f
Instruction ID: 4e65669566ff33fff318d6972ed44f75d70342564f487b879eb607d53b8e3a81
Opcode Fuzzy Hash: 914d03ebe5ee90f1f4c1a5f2b1c993fdec631088cbe9b0da6ce13adc057a7d1f
Instruction Fuzzy Hash: F5F0C2B6D00A0AEBDB24CF61C1047DAFBB8BB44714F14421AC42C63310D3787469CBD1

Function 029D49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f81b9073f027636039c119284f3890e2871990d629c76f87bd01934202d5b6
Instruction ID: 84be4d60c2268587d01fbed11bf2a7d80f38d7bc4bf85fcfafb0f849dd7cc30e
Opcode Fuzzy Hash: 70f81b9073f027636039c119284f3890e2871990d629c76f87bd01934202d5b6
Instruction Fuzzy Hash: 78F0C2B6D00A06EBDB24CF61C1047CAFBB4BB48714F14421AC42C67310D3787469CBD1

Function 029CDE6E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc515bf2f1bf18d7dfaca94e51efd7af2684fa818fac56d0ae76d03f780dffc7
Instruction ID: c794aea6c2716b89b84ac2a009f8379c6f1c19d5859339dd2a57e99234813688
Opcode Fuzzy Hash: dc515bf2f1bf18d7dfaca94e51efd7af2684fa818fac56d0ae76d03f780dffc7
Instruction Fuzzy Hash: 4FF0C2B6D00A06EBDB24CF61C1047CAFBB4BB44714F14421AC42C63710C7787469CBD1

Function 029D3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c803c6344a7dffb8eafb97a118467a75257c690364653a58fe397bfec5863958
Instruction ID: 3790e2ef8179775d2d3fb1ac1e4ffc3244ea3abfd5796466ff6376e65b61bc50
Opcode Fuzzy Hash: c803c6344a7dffb8eafb97a118467a75257c690364653a58fe397bfec5863958
Instruction Fuzzy Hash: EFF0C2B6D00A06EBDB24CFA1C1047CAFBB8BB44714F14421AC42C67310D3797469CBD1

Function 029D45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2912464736.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2e47187c361239ba4ac3098a065c7b326c98f9bdbe02cd492b4e3f5c37c524
Instruction ID: 89f8a3cb9519215416b3e4f14bfdefe85a2d9336cebbc3878058f4b00fd9bb74
Opcode Fuzzy Hash: ae2e47187c361239ba4ac3098a065c7b326c98f9bdbe02cd492b4e3f5c37c524
Instruction Fuzzy Hash: F9F0C2B6D00A06EBDB24CF61C1047CAFBB8BB44B14F14421AC52C67310D3787469CBD1

Analysis Process: javaw.exePID: 1984, Parent PID: 2580COMMON

Executed Functions

Function 028FD8F7 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c36b5fde0858ecefde6c8260a5519ec3e4f0a9edddeed27067ea965a79987f
Instruction ID: 386a6f74440e4e6798e67f34ff58c7b5ca5824a906139196db97f03cdc0480cd
Opcode Fuzzy Hash: 97c36b5fde0858ecefde6c8260a5519ec3e4f0a9edddeed27067ea965a79987f
Instruction Fuzzy Hash: 5FA1A97DA04601DFEB58CF24C494BA9FBB1FB49318F088199DB1A8B381D774A855CBA1

Function 028FD8E0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c198f7e5cb86ae3650f37fad242a074d35bdb6e19148166ef74fcf8387658ae1
Instruction ID: 363f76ac877a856fe1064924cfa1e1d0044eb80f315ca61168de8854d3184f90
Opcode Fuzzy Hash: c198f7e5cb86ae3650f37fad242a074d35bdb6e19148166ef74fcf8387658ae1
Instruction Fuzzy Hash: 4F61C979600641DFEB58CF24C494BAAFBB1FB49718F08819DEB1A8B381C774A855CB91

Function 02904DBC Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f621be90973922b9e77ba2eb7676939976d620e3f76687b62d3e59391494bf98
Instruction ID: 382468128f7448446f92b3a337326a3a307279df587dbc0421d4ba1a552d02d9
Opcode Fuzzy Hash: f621be90973922b9e77ba2eb7676939976d620e3f76687b62d3e59391494bf98
Instruction Fuzzy Hash: D621ACB6A0060ADFDB24CF24C48079AF7B5FF84314F285A5ACA189B391D334B821CB90

Function 028F0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b415306beff7c4ccbe8b47454e4a4a80dff93767198596e8e7d33aab8381c2
Instruction ID: dc43c130ac23af95bed9701ea7d29b1073523e9979811943bedc2e0df2e79d63
Opcode Fuzzy Hash: 26b415306beff7c4ccbe8b47454e4a4a80dff93767198596e8e7d33aab8381c2
Instruction Fuzzy Hash: 08118EBAD0022ACFCF54CF48C8814ADF3B0FB98315B558569DD69E3346D3356920CB81

Function 02904CCD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8723682098e54f368601b1954cf795a6cd029f615e38969d818f35514db7a5
Instruction ID: a1c2edce4fab12ef5bbfb6e750564e4f70da90a51e7413e203138e1498d58439
Opcode Fuzzy Hash: 8c8723682098e54f368601b1954cf795a6cd029f615e38969d818f35514db7a5
Instruction Fuzzy Hash: F2F0BCB9A00A06EBEB158F20C5047EAF7B4BB88708F04420AD42C57310C3787469CBD0

Function 028F0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89d1685702adc4a5b541d43cdbf5a0f8ee4379374bd06bc745fefd16649b533
Instruction ID: 55918a4cba85dff5d5a9f4df91f17810d792c09f1b780d4204555358fa054286
Opcode Fuzzy Hash: e89d1685702adc4a5b541d43cdbf5a0f8ee4379374bd06bc745fefd16649b533
Instruction Fuzzy Hash: 55F0157EC00229DF8B54DF48C4400ADB7B1EB44218B2A8496DD2CB7342D332AD62CF91

Function 02904B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbcd0777345a95fd82244e861b2a928b423d7c6eb71223352d5b9a75d4b108c7
Instruction ID: c6fbb16432d827d3a2a163d55b7710b6159a5945b7457b5774e158accae76982
Opcode Fuzzy Hash: cbcd0777345a95fd82244e861b2a928b423d7c6eb71223352d5b9a75d4b108c7
Instruction Fuzzy Hash: ADF07FB9A00A06EFDB158F61C5047DAFBB4BB88718F14421AD52C57350D77874698BC0

Function 02906495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6acc4ae5c74d06931e6ca1af8c80f140f5aee4bd73374fe4b5d23e87fc2d7157
Instruction ID: 818ba1d41fb7dbdafa005319f13759279fb6ce3eccc26a5420f9c9e5dd6a763e
Opcode Fuzzy Hash: 6acc4ae5c74d06931e6ca1af8c80f140f5aee4bd73374fe4b5d23e87fc2d7157
Instruction Fuzzy Hash: BFF092B9A00B16EBDB15CF65C5047CAFBB4BB48714F14421AC52C67350D7787469CBC0

Function 028FDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64116b00a5b6b61e85729ecb74ea6366a2fd1788528be47b4c7514d46d57c93
Instruction ID: 7bebd54e070d4b7a2ac8e34a2158a126191ef40dea701ccb3c60aeac57d8cde9
Opcode Fuzzy Hash: e64116b00a5b6b61e85729ecb74ea6366a2fd1788528be47b4c7514d46d57c93
Instruction Fuzzy Hash: 83F0C2BAD00A0AABDB248F61C5047DAFBB4BB44714F14421AC52C67310D3787469CBC1

Function 029049AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0661f5a5954bc111e540d173e5797dd4d9c86d5d235f68370a3dd21bd769c70
Instruction ID: 138cd3e3abfe481d6c3d9cb8320ec8ad246caf38fb6ce0ebc069baea2bf4092f
Opcode Fuzzy Hash: d0661f5a5954bc111e540d173e5797dd4d9c86d5d235f68370a3dd21bd769c70
Instruction Fuzzy Hash: B3F0C2BAD00A06ABDB248F61C5047CAFBB4BB48714F14421AC52C67310D3787469CBC0

Function 028FDE6E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a190a1d0a175dca585861e2f1156b36e7cbd666c4a38f4bbb6dc867dff3edd
Instruction ID: db21eece4534fdf67d27b6ddf0b5b4e9e07a81b78f718c2a60a45c7de9e9c031
Opcode Fuzzy Hash: 77a190a1d0a175dca585861e2f1156b36e7cbd666c4a38f4bbb6dc867dff3edd
Instruction Fuzzy Hash: 4DF0C2BAD00A06EBDB248F61C5047CAFBB4BB44714F14421AC52C67710C7787469CBC0

Function 02903C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd9ed7c67356edf23f901b70de538f4381b2494db95ee6a6f3294803b79283a
Instruction ID: e0e51d2dc4f92cfa888efbb2b16bd53dbaf4408b7bbdce524b88768e86039699
Opcode Fuzzy Hash: 1dd9ed7c67356edf23f901b70de538f4381b2494db95ee6a6f3294803b79283a
Instruction Fuzzy Hash: 3AF0C2BAD00A06AFDB648F61C5047CAFBB4BB44714F14421AC52C67310D3797469CBC1

Function 029045E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1086a74f2398616588975ba3ceec1d33c238eca309933c0ecdaf1d5bd8b35d8
Instruction ID: 602abd83fb9305530edbddb4d2efd76c030f460fb2d1c99df3c5993320a52d4b
Opcode Fuzzy Hash: b1086a74f2398616588975ba3ceec1d33c238eca309933c0ecdaf1d5bd8b35d8
Instruction Fuzzy Hash: 3DF0C2BAD00A06ABDB248F61C5047CAFBB4BB44B14F14421AC52C67310D3787469CBC0

Function 02904DD4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2912900829.00000000028F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_28f2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8011308744411d5ad211e05cd1e88567d4a2342cd89565fd93737881b4fdd658
Instruction ID: 8ab685db4e07b8c450d7dfe6e67d3986d5fcbe997598d31c60c3eb52a8b82eab
Opcode Fuzzy Hash: 8011308744411d5ad211e05cd1e88567d4a2342cd89565fd93737881b4fdd658
Instruction Fuzzy Hash: 86F0C2B9D00A06ABDB24CF61C10438AF7B4BB44B14F14421AC52C67310C378B465CBC1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Form-8879_PDF.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\1700

C:\Users\user\AppData\Local\Temp\hsperfdata_user\1984

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6576

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

C:\jar\META-INF\MANIFEST.MF

C:\jar\config.dat

C:\jar\key.dat

C:\jar\qt314\A.class

C:\jar\qt314\B.class

C:\jar\qt314\C.class

C:\jar\qt314\D.class

C:\jar\qt314\M.class

C:\jar\qt314\N.class

C:\jar\qt314\O.class

C:\jar\qt314\P.class

C:\jar\qt314\Q.class

C:\jar\qt314\S.class

C:\jar\qt314\T.class

C:\jar\qt314\Y.class

C:\jar\qt314\Z.class

C:\jar\qt314\a0.class

C:\jar\qt314\a1.class

Windows Analysis Report
Form-8879_PDF.jar