Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
bZPAo2e2Pv.jar

Overview

General Information

Sample name:bZPAo2e2Pv.jar
renamed because original name is a hash value
Original sample name:45cbb31ac832781dcd07ed72c7d947ed9060453b5bbd44b2b8f7955dbc283d9d.jar
Analysis ID:1560317
MD5:0e929dc2d517690e49d95ec4ffeb067b
SHA1:3793bd95395f32d677ed7877972ee38c1581089a
SHA256:45cbb31ac832781dcd07ed72c7d947ed9060453b5bbd44b2b8f7955dbc283d9d
Tags:jartelegram-bot7771186573user-JAMESWT_MHT
Infos:

Detection

Can Stealer
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Can Stealer
AI detected suspicious sample
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Performs DNS queries to domains with low reputation
Sigma detected: Suspicious Processes Spawned by Java.EXE
Tries to harvest and steal browser information (history, passwords, etc)
Uses the Telegram API (likely for C&C communication)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 6824 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar"" >> C:\cmdlinestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • conhost.exe (PID: 6832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • java.exe (PID: 6880 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar" MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)
      • icacls.exe (PID: 6928 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)
        • conhost.exe (PID: 6940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 6952 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
        • conhost.exe (PID: 6976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 7072 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 7132 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 5796 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6304 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6436 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6540 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 3628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 5844 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 5744 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 5208 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 4132 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 5900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 856 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 3728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 5704 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6944 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6980 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6068 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 7072 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 6216 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)
        • conhost.exe (PID: 6188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 6356 cmdline: wmic cpu get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)
        • conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 3608 cmdline: wmic os get Caption /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)
        • conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 5688 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 5516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 2712 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 2728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 5588 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)
        • conhost.exe (PID: 5900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 6044 cmdline: wmic cpu get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)
        • conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 6992 cmdline: wmic os get Caption /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)
        • conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 5276 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 7132 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 3776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 1952 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 2844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6396 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 2528 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 2172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 3640 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 3400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 2476 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 5800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 660 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6732 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 1500 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 3816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • HOSTNAME.EXE (PID: 6028 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)
        • conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CanStealerYara detected Can StealerJoe Security
    00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CanStealerYara detected Can StealerJoe Security
      Process Memory Space: java.exe PID: 6880JoeSecurity_CanStealerYara detected Can StealerJoe Security
        Process Memory Space: java.exe PID: 6880JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Suspicious Processes Spawned by Java.EXE
          Source: Process startedAuthor: Andreas Hunkeler (@Karneades), Florian Roth: Data: Command: wmic path win32_VideoController get name, CommandLine: wmic path win32_VideoController get name, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 6880, ParentProcessName: java.exe, ProcessCommandLine: wmic path win32_VideoController get name, ProcessId: 6216, ProcessName: WMIC.exe
          Sigma detected: Suspicious Execution of Hostname
          Source: Process startedAuthor: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\SysWOW64\HOSTNAME.EXE, NewProcessName: C:\Windows\SysWOW64\HOSTNAME.EXE, OriginalFileName: C:\Windows\SysWOW64\HOSTNAME.EXE, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 6880, ParentProcessName: java.exe, ProcessCommandLine: hostname, ProcessId: 7072, ProcessName: HOSTNAME.EXE

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: bZPAo2e2Pv.jarAvira: detected
          Multi AV Scanner detection for submitted file
          Source: bZPAo2e2Pv.jarReversingLabs: Detection: 15%
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 95.7% probability
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Temp\jna-92896885\jna3139189163944155017.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Temp\jna-92896885\Jump to behavior

          Software Vulnerabilities

          barindex
          Exploit detected, runtime environment starts unknown processes
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\tasklist.exe

          Networking

          barindex
          Performs DNS queries to domains with low reputation
          Source: DNS query: canstlr.xyz
          Source: DNS query: canstlr.xyz
          Uses the Telegram API (likely for C&C communication)
          Source: unknownDNS query: name: api.telegram.org
          Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
          Source: Joe Sandbox ViewIP Address: 45.112.123.126 45.112.123.126
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficDNS traffic detected: DNS query: api.gofile.io
          Source: global trafficDNS traffic detected: DNS query: canstlr.xyz
          Source: global trafficDNS traffic detected: DNS query: api.telegram.org
          Source: global trafficDNS traffic detected: DNS query: github.com
          Source: java.exe, 00000002.00000002.2654014012.000000000A3F7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://bugreport.sun.com/bugreport/
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.htmlC
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.htmlk
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crlk
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
          Source: java.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
          Source: java.exe, 00000002.00000002.2654014012.000000000A350000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://java.oracle.com/
          Source: java.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2658265307.00000000156BD000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398969302.0000000015708000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398660167.00000000156C6000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://null.oracle.com/
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
          Source: java.exe, 00000002.00000002.2654014012.000000000A4AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
          Source: java.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com#
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com0
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.comk
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/0
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/3
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/C
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/S
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/k
          Source: java.exe, 00000002.00000002.2654014012.000000000A94C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org1
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.orgC
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bmk
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/servers
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/serversk
          Source: java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2658929285.0000000015A50000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
          Source: java.exe, 00000002.00000002.2658929285.0000000015A50000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
          Source: java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2658929285.0000000015A50000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
          Source: java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.tele
          Source: java.exe, 00000002.00000002.2635926954.000000000519D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
          Source: java.exe, 00000002.00000002.2635926954.0000000005188000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2635926954.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
          Source: java.exe, 00000002.00000002.2635926954.0000000005188000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk
          Source: java.exe, 00000002.00000002.2635926954.000000000519D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessage
          Source: java.exe, 00000002.00000002.2635926954.0000000005188000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessageSC/
          Source: java.exe, 00000002.00000002.2635926954.000000000525B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot;U/
          Source: java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyC
          Source: java.exe, 00000002.00000002.2635926954.0000000004E3E000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/
          Source: java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/a
          Source: java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/ap3
          Source: java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/api/v6/guilds/
          Source: java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/api/v6/users/
          Source: java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/api/v9/users/
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/apple3
          Source: java.exe, 00000002.00000002.2635926954.0000000005088000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/apple3C
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://canstlr.xyz/apple4
          Source: java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.disco
          Source: java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
          Source: java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/embed/avatars/0.png
          Source: java.exe, 00000002.00000002.2659859380.0000000016560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/embed/avatars/0.png8
          Source: java.exe, 00000002.00000002.2635926954.0000000004EDB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com
          Source: java.exe, 00000002.00000002.2635926954.0000000004EDB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/sonriseclient/bneapple-startup-5947/raw/refs/heads/main/Java.jar
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
          Source: java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.comK
          Source: java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://paste-pgpj.onrender.com/?p=
          Source: java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://paste-pgpj.onrender.com/?p=12
          Source: java.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lu
          Source: java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lu0
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lu3(w
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lu;
          Source: java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://repository.luxtrust.lus(w
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
          Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
          Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16965C102_3_16965C10
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16965F742_3_16965F74
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16965C102_3_16965C10
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16965F742_3_16965F74
          Source: classification engineClassification label: mal92.troj.spyw.expl.winJAR@119/15@5/3
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06Jump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5720:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2172:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7140:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6988:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2728:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3728:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3400:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6592:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3816:120:WilError_03
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5696:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3628:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6832:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7052:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3776:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6012:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5900:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2844:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5516:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_03
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile created: C:\Users\user\AppData\Local\Temp\hsperfdata_userJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
          Source: java.exe, 00000002.00000002.2664043396.0000000065BC4000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
          Source: java.exe, 00000002.00000003.2382820718.0000000016D92000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2383108963.0000000016DAD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
          Source: bZPAo2e2Pv.jarReversingLabs: Detection: 15%
          Source: java.exeString found in binary or memory: (Lokhttp3/Address;)Z
          Source: java.exeString found in binary or memory: gLokhttp3/Address;
          Source: java.exeString found in binary or memory: ./Q()Lokhttp3/Address;
          Source: java.exeString found in binary or memory: (Lokhttp3/Address;Lokhttp3/internal/connection/RealCall;Ljava/util/List;Z)Z
          Source: java.exeString found in binary or memory: -addNetworkInterceptor
          Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar"" >> C:\cmdlinestart.log 2>&1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar"
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
          Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
          Source: C:\Windows\SysWOW64\tasklist.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar" Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /valueJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /valueJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: wsock32.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: version.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: dwmapi.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: opengl32.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: glu32.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dllJump to behavior
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: mswsock.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: napinsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: pnrpnsp.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: wshbth.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: nlaapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: dnsapi.dll
          Source: C:\Windows\SysWOW64\HOSTNAME.EXESection loaded: winrnr.dll
          Source: C:\Windows\SysWOW64\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
          Source: bZPAo2e2Pv.jarStatic file information: File size 14111939 > 1048576
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963CDB push es; ret 2_3_16963CDC
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963CEE push es; retf 2_3_16963D04
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963BD6 push es; retn 0009h2_3_16963CD7
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963D11 push es; iretd 2_3_16963D18
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963BD6 push es; retn 0009h2_3_16963CD7
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963CDB push es; ret 2_3_16963CDC
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963CEE push es; retf 2_3_16963D04
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16963D11 push es; iretd 2_3_16963D18
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DACF78 push eax; iretd 2_3_15DACF79
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DB328B push cs; retf 2_3_15DB329E
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DB3280 push cs; retf 2_3_15DB328A
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DAC421 push esp; retf 2_3_15DAC422
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DACF78 push eax; iretd 2_3_15DACF79
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DB328B push cs; retf 2_3_15DB329E
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DB3280 push cs; retf 2_3_15DB328A
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15DAC421 push esp; retf 2_3_15DAC422
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_15CCE335 push cs; retf 2_3_15CCE336
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_16CF550B push ebp; iretd 2_3_16CF5532
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeCode function: 2_3_17ACCEB7 push eax; iretd 2_3_17ACCEC1

          Persistence and Installation Behavior

          barindex
          Exploit detected, runtime environment dropped PE file
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile created: jna3139189163944155017.dll.2.drJump to dropped file
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile created: C:\Users\user\AppData\Local\Temp\jna-92896885\jna3139189163944155017.dllJump to dropped file
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile created: C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-40faf7a8-eb23-48f9-802d-09995356935d-sqlitejdbc.dllJump to dropped file
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
          Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jna-92896885\jna3139189163944155017.dllJump to dropped file
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-40faf7a8-eb23-48f9-802d-09995356935d-sqlitejdbc.dllJump to dropped file
          Source: C:\Windows\SysWOW64\HOSTNAME.EXEWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Temp\jna-92896885\jna3139189163944155017.dllJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Temp\jna-92896885\Jump to behavior
          Source: HOSTNAME.EXE, 0000003F.00000002.2574638973.00000000035A7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6
          Source: java.exe, 00000002.00000003.2336599116.000000001526E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
          Source: java.exe, 00000002.00000003.2336599116.000000001526E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
          Source: java.exe, 00000002.00000002.2634831559.00000000011EB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [Ljava/lang/VirtualMachineError;
          Source: java.exe, 00000002.00000003.2336599116.000000001526E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: org/omg/CORBA/OMGVMCID.classPK
          Source: java.exe, 00000002.00000002.2634831559.00000000011EB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cjava/lang/VirtualMachineError
          Source: java.exe, 00000002.00000003.2336599116.000000001526E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: java/lang/VirtualMachineError.classPK
          Source: java.exe, 00000002.00000002.2634831559.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000007.00000002.2384151808.000000000312B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000009.00000002.2390743005.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 0000000B.00000002.2391772355.000000000071B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 0000000D.00000002.2393171830.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 0000000F.00000002.2393718763.000000000318A000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000011.00000002.2396370562.000000000331B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000013.00000002.2429153593.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000015.00000002.2429741661.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000019.00000002.2431834990.0000000002BFB000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 0000001B.00000002.2432616954.0000000000A3B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: HOSTNAME.EXE, 00000017.00000002.2430996591.0000000002E3B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^
          Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information queried: ProcessInformation
          Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeMemory protected: page read and write | page guardJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar" Jump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /valueJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get nameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /valueJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: C:\Windows\SysWOW64\HOSTNAME.EXE hostnameJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\6880 VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\cookies.txt VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\edgepass.txt VolumeInformationJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected Can Stealer
          Source: Yara matchFile source: 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: java.exe PID: 6880, type: MEMORYSTR
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
          Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
          Source: Yara matchFile source: Process Memory Space: java.exe PID: 6880, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Yara detected Can Stealer
          Source: Yara matchFile source: 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: java.exe PID: 6880, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
          Windows Management Instrumentation          		1
          Services File Permissions Weakness          		11
          Process Injection          		1
          Masquerading          		1
          OS Credential Dumping          		11
          Security Software Discovery          		Remote Services1
          Archive Collected Data          		1
          Web Service          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts2
          Command and Scripting Interpreter          		1
          DLL Side-Loading          		1
          Services File Permissions Weakness          		1
          Virtualization/Sandbox Evasion          		LSASS Memory1
          Virtualization/Sandbox Evasion          		Remote Desktop Protocol1
          Data from Local System          		12
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts2
          Exploitation for Client Execution          		Logon Script (Windows)1
          DLL Side-Loading          		1
          Disable or Modify Tools          		Security Account Manager2
          Process Discovery          		SMB/Windows Admin SharesData from Network Shared Drive1
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
          Process Injection          		NTDS1
          File and Directory Discovery          		Distributed Component Object ModelInput Capture2
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Obfuscated Files or Information          		LSA Secrets13
          System Information Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Services File Permissions Weakness          		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1560317 Sample: bZPAo2e2Pv.jar Startdate: 21/11/2024 Architecture: WINDOWS Score: 92 44 canstlr.xyz 2->44 46 api.telegram.org 2->46 48 2 other IPs or domains 2->48 56 Antivirus / Scanner detection for submitted sample 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 Yara detected Can Stealer 2->60 66 4 other signatures 2->66 9 cmd.exe 2 2->9         started        signatures3 62 Performs DNS queries to domains with low reputation 44->62 64 Uses the Telegram API (likely for C&C communication) 46->64 process4 process5 11 java.exe 57 9->11         started        16 conhost.exe 9->16         started        dnsIp6 50 api.telegram.org 149.154.167.220, 443, 49717, 49719 TELEGRAMRU United Kingdom 11->50 52 github.com 20.233.83.145, 443, 49720 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->52 54 api.gofile.io 45.112.123.126, 443, 49711, 49718 AMAZON-02US Singapore 11->54 40 sqlite-3.20.1-40fa...935d-sqlitejdbc.dll, PE32 11->40 dropped 42 C:\Users\user\...\jna3139189163944155017.dll, PE32 11->42 dropped 68 Tries to harvest and steal browser information (history, passwords, etc) 11->68 18 tasklist.exe 1 11->18         started        20 icacls.exe 1 11->20         started        22 HOSTNAME.EXE 1 11->22         started        24 34 other processes 11->24 file7 signatures8 process9 process10 26 conhost.exe 18->26         started        28 conhost.exe 20->28         started        30 conhost.exe 22->30         started        32 conhost.exe 24->32         started        34 conhost.exe 24->34         started        36 conhost.exe 24->36         started        38 31 other processes 24->38

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          bZPAo2e2Pv.jar16%ReversingLabsPackage.Trojan.Generic
          bZPAo2e2Pv.jar100%AviraJAVA/Spy.Agent.wlsah

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Local\Temp\jna-92896885\jna3139189163944155017.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-40faf7a8-eb23-48f9-802d-09995356935d-sqlitejdbc.dll0%ReversingLabs

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.chambersign.orgC0%Avira URL Cloudsafe
          http://repository.swisssign.com/C0%Avira URL Cloudsafe
          https://ocsp.quovadisoffshore.comK0%Avira URL Cloudsafe
          https://canstlr.xyz/api/v6/guilds/0%Avira URL Cloudsafe
          http://cps.chambersign.org/cps/chambersroot.htmlC0%Avira URL Cloudsafe
          https://cdn.disco0%Avira URL Cloudsafe
          https://canstlr.xyz/api/v6/users/0%Avira URL Cloudsafe
          https://paste-pgpj.onrender.com/?p=120%Avira URL Cloudsafe
          http://repository.swisssign.com/30%Avira URL Cloudsafe
          https://repository.luxtrust.lu3(w0%Avira URL Cloudsafe
          http://repository.swisssign.com/S0%Avira URL Cloudsafe
          https://canstlr.xyz/a0%Avira URL Cloudsafe
          http://www.quovadis.bmk0%Avira URL Cloudsafe
          https://canstlr.xyz/apple40%Avira URL Cloudsafe
          http://repository.swisssign.com/k0%Avira URL Cloudsafe
          http://cps.chambersign.org/cps/chambersroot.htmlk0%Avira URL Cloudsafe
          https://canstlr.xyz/apple30%Avira URL Cloudsafe
          https://paste-pgpj.onrender.com/?p=0%Avira URL Cloudsafe
          http://crl.chambersign.org/chambersroot.crlk0%Avira URL Cloudsafe
          http://policy.camerfirma.com#0%Avira URL Cloudsafe
          https://canstlr.xyz/apple3C0%Avira URL Cloudsafe
          https://canstlr.xyC0%Avira URL Cloudsafe
          https://canstlr.xyz/ap30%Avira URL Cloudsafe
          https://canstlr.xyz/api/v9/users/0%Avira URL Cloudsafe
          https://canstlr.xyz/0%Avira URL Cloudsafe
          http://policy.camerfirma.comk0%Avira URL Cloudsafe
          https://repository.luxtrust.lus(w0%Avira URL Cloudsafe
          https://repository.luxtrust.lu;0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          github.com
          		20.233.83.145
          		truefalse
            		high
            api.telegram.org
            		149.154.167.220
            		truefalse
              		high
              api.gofile.io
              		45.112.123.126
              		truefalse
                		high
                canstlr.xyz
                		unknown
                		unknowntrue
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://www.chambersign.orgCjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2658929285.0000000015A50000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://crl.chambersign.org/chambersroot.crl0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://api.telegram.orgjava.exe, 00000002.00000002.2635926954.000000000519D000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://canstlr.xyz/api/v6/guilds/java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://repository.swisssign.com/Cjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://api.telegram.org/botjava.exe, 00000002.00000002.2635926954.0000000005188000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2635926954.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://github.comjava.exe, 00000002.00000002.2635926954.0000000004EDB000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://repository.luxtrust.lu0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://cps.chambersign.org/cps/chambersroot.html0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.chambersign.org1java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://repository.swisssign.com/0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&sjava.exe, 00000002.00000002.2658929285.0000000015A50000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://policy.camerfirma.comjava.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://repository.swisssign.com/3java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://ocsp.quovadisoffshore.comKjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://canstlr.xyz/api/v6/users/java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://ocsp.quovadisoffshore.comjava.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://crl.securetrust.com/STCA.crl0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://paste-pgpj.onrender.com/?p=12java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://cps.chambersign.org/cps/chambersroot.htmlCjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://cdn.discojava.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://repository.luxtrust.lujava.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.quovadisglobal.com/cps0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://repository.luxtrust.lu3(wjava.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://repository.swisssign.com/kjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://canstlr.xyz/ajava.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://repository.swisssign.com/Sjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://ocsp.quovadisoffshore.com0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.quovadis.bmkjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://github.com/sonriseclient/bneapple-startup-5947/raw/refs/heads/main/Java.jarjava.exe, 00000002.00000002.2635926954.0000000004EDB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://repository.swisssign.com/java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.chambersign.orgjava.exe, 00000002.00000002.2654014012.000000000A94C000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessagejava.exe, 00000002.00000002.2635926954.000000000519D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://canstlr.xyz/apple4java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://policy.camerfirma.com0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://canstlr.xyz/apple3java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://crl.xrampsecurity.com/XGCA.crljava.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://cdn.discordapp.com/embed/avatars/0.png8java.exe, 00000002.00000002.2659859380.0000000016560000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://cps.chambersign.org/cps/chambersroot.htmlkjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://paste-pgpj.onrender.com/?p=java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://api.gofile.io/serversjava.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://crl.chambersign.org/chambersroot.crlkjava.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://bugreport.sun.com/bugreport/java.exe, 00000002.00000002.2654014012.000000000A3F7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://policy.camerfirma.com#java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://canstlr.xyz/apple3Cjava.exe, 00000002.00000002.2635926954.0000000005088000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://java.oracle.com/java.exe, 00000002.00000002.2654014012.000000000A350000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://null.oracle.com/java.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2658265307.00000000156BD000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398969302.0000000015708000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398660167.00000000156C6000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSkjava.exe, 00000002.00000002.2635926954.0000000005188000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&sjava.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2658929285.0000000015A50000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://canstlr.xyCjava.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.quovadisglobal.com/cpsjava.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://api.gofile.io/serverskjava.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://cps.chambersign.org/cps/chambersroot.htmljava.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessageSC/java.exe, 00000002.00000002.2635926954.0000000005188000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://api.telegram.org/bot;U/java.exe, 00000002.00000002.2635926954.000000000525B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://canstlr.xyz/ap3java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://canstlr.xyz/api/v9/users/java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://crl.securetrust.com/STCA.crljava.exe, 00000002.00000002.2654014012.000000000A66A000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://canstlr.xyz/java.exe, 00000002.00000002.2635926954.0000000004E3E000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://crl.xrampsecurity.com/XGCA.crl0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://api.telejava.exe, 00000002.00000003.2398411038.000000001686B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://repository.luxtrust.lus(wjava.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://cdn.discordapp.com/embed/avatars/0.pngjava.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.quovadis.bmjava.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.quovadis.bm0java.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://policy.camerfirma.comkjava.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://cdn.discordapp.com/avatars/java.exe, 00000002.00000002.2659859380.0000000016852000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2398411038.00000000168F8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2454643064.00000000168E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://crl.chambersign.org/chambersroot.crljava.exe, 00000002.00000002.2654014012.000000000A790000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2654014012.000000000AC97000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://repository.luxtrust.lu;java.exe, 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown

                                                                                                      World Map of Contacted IPs

                                                                                                      • No. of IPs < 25%
                                                                                                      • 25% < No. of IPs < 50%
                                                                                                      • 50% < No. of IPs < 75%
                                                                                                      • 75% < No. of IPs

                                                                                                      Public IPs

                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                      149.154.167.220
                                                                                                      		api.telegram.orgUnited Kingdom
                                                                                                      		62041TELEGRAMRUfalse
                                                                                                      45.112.123.126
                                                                                                      		api.gofile.ioSingapore
                                                                                                      		16509AMAZON-02USfalse
                                                                                                      20.233.83.145
                                                                                                      		github.comUnited States
                                                                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                                                                                                      General Information

                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                      Analysis ID:1560317
                                                                                                      Start date and time:2024-11-21 16:59:16 +01:00
                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                      Overall analysis duration:0h 10m 33s
                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                      Report type:full
                                                                                                      Cookbook file name:defaultwindowsfilecookbook.jbs
                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                      Number of analysed new started processes analysed:79
                                                                                                      Number of new started drivers analysed:0
                                                                                                      Number of existing processes analysed:0
                                                                                                      Number of existing drivers analysed:0
                                                                                                      Number of injected processes analysed:0
                                                                                                      Technologies:
                                                                                                      • HCA enabled
                                                                                                      • EGA enabled
                                                                                                      • GSI enabled (Java)
                                                                                                      • AMSI enabled
                                                                                                      Analysis Mode:default
                                                                                                      Analysis stop reason:Timeout
                                                                                                      Sample name:bZPAo2e2Pv.jar
                                                                                                      renamed because original name is a hash value
                                                                                                      Original Sample Name:45cbb31ac832781dcd07ed72c7d947ed9060453b5bbd44b2b8f7955dbc283d9d.jar
                                                                                                      Detection:MAL
                                                                                                      Classification:mal92.troj.spyw.expl.winJAR@119/15@5/3
                                                                                                      EGA Information:Failed
                                                                                                      HCA Information:
                                                                                                      • Successful, ratio: 100%
                                                                                                      • Number of executed functions: 0
                                                                                                      • Number of non-executed functions: 2
                                                                                                      Cookbook Comments:
                                                                                                      • Found application associated with file extension: .jar

                                                                                                      Warnings

                                                                                                      • Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
                                                                                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                      • Execution Graph export aborted for target java.exe, PID 6880 because there are no executed function
                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                      • Reached maximum number of file to list during submission archive extraction
                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                      • Report size getting too big, too many NtWriteFile calls found.
                                                                                                      • VT rate limit hit for: bZPAo2e2Pv.jar

                                                                                                      Simulations

                                                                                                      Behavior and APIs

                                                                                                      TimeTypeDescription
                                                                                                      11:00:27API Interceptor6x Sleep call for process: WMIC.exe modified

                                                                                                      Joe Sandbox View / Context

                                                                                                      IPs

                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      149.154.167.220order requirements CIF-TRC809945210.exeGet hashmaliciousGuLoaderBrowse
                                                                                                        Updated Invoice_0755404645-2024_pdf.exeGet hashmaliciousUnknownBrowse
                                                                                                          CONTRACT COPY PRN00720387_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                            Request for Quotation MK FMHS.RFQ.24.11.21.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                              PO-841122676_g787.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                Wire slip account payable.pif.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                  Order requirements CIF Greece_pdf.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                    ORDER 20240986 OA.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                      Documents.pdf.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                        DEVIS_VALIDE.jsGet hashmaliciousXWormBrowse
                                                                                                                          45.112.123.126iDvmIRCPBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                            ZdXUGLQpoL.exeGet hashmaliciousUnknownBrowse
                                                                                                                              jaPB8q3WL1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                yx7VCK1nxU.exeGet hashmaliciousUnknownBrowse
                                                                                                                                  RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                    file.exeGet hashmaliciousCStealerBrowse
                                                                                                                                      dens.exeGet hashmaliciousPython Stealer, Exela Stealer, Waltuhium GrabberBrowse
                                                                                                                                        file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                          Creal.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                            #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exeGet hashmaliciousBlank Grabber, Creal StealerBrowse
                                                                                                                                              20.233.83.145https://linkchainsfix.vercel.app/Get hashmaliciousHTMLPhisherBrowse

                                                                                                                                                Domains

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                api.gofile.ioiDvmIRCPBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                ZdXUGLQpoL.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                jaPB8q3WL1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                yx7VCK1nxU.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                file.exeGet hashmaliciousCStealerBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                dens.exeGet hashmaliciousPython Stealer, Exela Stealer, Waltuhium GrabberBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                Creal.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exeGet hashmaliciousBlank Grabber, Creal StealerBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                https://gofile.io/d/IAr464Get hashmaliciousUnknownBrowse
                                                                                                                                                • 45.112.123.126
                                                                                                                                                github.comhttps://github.com/karakun/OpenWebStart/releases/download/v1.10.1/OpenWebStart_windows-x64_1_10_1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 140.82.121.4
                                                                                                                                                kIMPADTn5g.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                                                                                                                • 140.82.121.3
                                                                                                                                                SWIFT-MT103-17112024.jsGet hashmaliciousSTRRATBrowse
                                                                                                                                                • 140.82.121.3
                                                                                                                                                SWIFT-MT103-17112024.jsGet hashmaliciousSTRRATBrowse
                                                                                                                                                • 140.82.121.3
                                                                                                                                                Nota1893.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 140.82.121.4
                                                                                                                                                Requerimento.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 140.82.121.4
                                                                                                                                                Nota1893.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 140.82.121.4
                                                                                                                                                Requerimento.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 140.82.121.4
                                                                                                                                                VerificarRequerimento.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 140.82.121.3
                                                                                                                                                VerificarRequerimento.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 140.82.121.3
                                                                                                                                                api.telegram.orgorder requirements CIF-TRC809945210.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Updated Invoice_0755404645-2024_pdf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                CONTRACT COPY PRN00720387_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Request for Quotation MK FMHS.RFQ.24.11.21.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                PO-841122676_g787.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Wire slip account payable.pif.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Order requirements CIF Greece_pdf.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                ORDER 20240986 OA.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Documents.pdf.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                DEVIS_VALIDE.jsGet hashmaliciousXWormBrowse
                                                                                                                                                • 149.154.167.220

                                                                                                                                                ASNs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                TELEGRAMRUS0FTWARE.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                • 149.154.167.99
                                                                                                                                                order requirements CIF-TRC809945210.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                qaHUaPUib8.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 149.154.167.99
                                                                                                                                                qaHUaPUib8.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 149.154.167.99
                                                                                                                                                Updated Invoice_0755404645-2024_pdf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                CONTRACT COPY PRN00720387_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Request for Quotation MK FMHS.RFQ.24.11.21.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                PO-841122676_g787.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Wire slip account payable.pif.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                Order requirements CIF Greece_pdf.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                • 149.154.167.220
                                                                                                                                                AMAZON-02USOGo8AQxn4k.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                • 185.166.143.48
                                                                                                                                                3o2WdGwcLF.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                • 185.166.143.50
                                                                                                                                                Mandatory Notice for all December Leave and Vacation application.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                • 13.248.169.48
                                                                                                                                                la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 34.243.160.129
                                                                                                                                                https://bitly.cx/aMW9O9Get hashmaliciousUnknownBrowse
                                                                                                                                                • 18.200.123.41
                                                                                                                                                dvLKUpkeV8.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 54.171.230.55
                                                                                                                                                phish_alert_sp2_2.0.0.0.emlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 13.248.176.92
                                                                                                                                                https://url.uk.m.mimecastprotect.com/s/1u4eCqxlyukZk7ltZfxHE-ELz?domain=andy-25.simvoly.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 18.245.31.108
                                                                                                                                                https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779Get hashmaliciousKnowBe4Browse
                                                                                                                                                • 52.214.139.140
                                                                                                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSNovember Billing.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 13.107.246.63
                                                                                                                                                Quote Request.emlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 52.98.151.66
                                                                                                                                                u.xlsGet hashmaliciousBraodoBrowse
                                                                                                                                                • 13.107.246.63
                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 13.107.246.63
                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                • 94.245.104.56
                                                                                                                                                S0FTWARE.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                • 94.245.104.56
                                                                                                                                                https://1drv.ms/o/c/1ba8fd2bd98c98a8/EmMMbLWVyqxBh9Z6zxri2ZUBVkwUpSiY2KbvhupkdaFzGA?e=F6pNlDGet hashmaliciousUnknownBrowse
                                                                                                                                                • 52.108.8.12
                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 13.107.246.44
                                                                                                                                                Kellyb Timesheet Report.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • 20.190.159.68
                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                • 13.107.246.44

                                                                                                                                                JA3 Fingerprints

                                                                                                                                                ⊘No context

                                                                                                                                                Dropped Files

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                C:\Users\user\AppData\Local\Temp\jna-92896885\jna3139189163944155017.dllsoinjector.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  https://www.eclipse.org/downloads/download.php?file=/oomph/epp/2024-03/R/eclipse-inst-jre-win64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                    C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-40faf7a8-eb23-48f9-802d-09995356935d-sqlitejdbc.dllsoinjector.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                      Created / dropped Files

                                                                                                                                                      C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):52
                                                                                                                                                      Entropy (8bit):4.935546689086913
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:oFj4I5vpm4USakEy:oJ5baa
                                                                                                                                                      MD5:B7F773E4FCD0D9055CDB961B9C0FAB18
                                                                                                                                                      SHA1:74D5CD20E771D44889BB67093DD33E308A7BA90A
                                                                                                                                                      SHA-256:85FFBEB365FC0BA7561D48C357B32B8CFD09EFF6129F0686FE99F81CFB02AC26
                                                                                                                                                      SHA-512:E8BC09585EA3F8D83997CA38F171FEEB58B919402B12C66CB5B5D191DE91E0A6544DE8D72CB20F7F8ADB00B2DF237D824FAA4405FD297C504F062046D5354C55
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:C:\Program Files (x86)\Java\jre-1.8..1732204817554..

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\179605.zip

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):569183
                                                                                                                                                      Entropy (8bit):7.998402227577905
                                                                                                                                                      Encrypted:true
                                                                                                                                                      SSDEEP:12288:dp71wxFJSeZcG5LhXbv17au+7KBXS1Ftn5Co0k7dcUd:exTFcehb+7+EF2o3hd
                                                                                                                                                      MD5:EFFA00FCDEFB3A27212A5FB20917D150
                                                                                                                                                      SHA1:D20B3AD2BB2E8BAD839484508CDEF64D677C61FF
                                                                                                                                                      SHA-256:DBADC07EEFADDA4EADBD3688E841F5FB2D6D5B5295E134EFBF095933576FC274
                                                                                                                                                      SHA-512:6E0FE85EABEA938532FFADFB92D47DD8BE5BEBFC36BFB5805C2ED398E4DFC3B921351225B966B1A2DC929EB9E1489D9EACB88B937A91E45B7AE570101DB1D9C8
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:PK.........XuY............"...Browsers/Chrome/Default/cookie.txt...vC0.....]bI.s..8jU...:n...*'T(}....O.....R...0.7.0?..BM...Fu.O.... .B. .....xpm@1.......j../..'..e...xb..`}~..F...cq.4..=f.K...4..2.\.....I...W..(q.!.+L.........tR........\.ZWh.#f.Y\W"...Dr2d.s.d.>.7.PK.....B........PK.........XuY............$...Browsers/Microsoft Edge/password.txt..PK..............PK.........XuY................Game/craftrise.txt.........PK..g.C.........PK.........XuY................Game/sonoyuncu.txt.........PK..g.C.........PK.........XuY................screenshot.png..uT....gw...QA%...D.T.]r..n..D..[@...RKH,-].4H#./...93s.9.......y..j*..2...@....=...........C.....T^.}..i......$.[.@E..^.s..z...t..j.u?cl7...D.e.<.#.>C...:-..C....W.:U..z....M...........A].n......:P.^....W.x[..Z...m.Dj....{t....KH.Ml.G<N#..s.kO+.R..IJ9n...,.M".......z...O....O.N..-_c)ci9.+..p..+.......?b.NU.....>.....v...Wd..G..p_..a....,)......x\.....S.4..`.}.......#..a.W.f.j.QO.M.ykL...no

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\179605\Browsers\Chrome\Default\cookie.txt (copy)

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:ASCII text
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):273
                                                                                                                                                      Entropy (8bit):5.825524542035742
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6:Pk3rocHDyzxb6t+3rocHDKJJch1URW6Di7zxJVdGIIn5kT/C:c79EU+79LODyxIn5N
                                                                                                                                                      MD5:3CCFB5196DF424FFC2A0D9B9C6522529
                                                                                                                                                      SHA1:006A97F1810291522345DEB3A435B0F994747BB6
                                                                                                                                                      SHA-256:44EF3C31F63DDFC34F18D4140A9DCB055403B66B3E7B1876D01C6E94BB29F1AE
                                                                                                                                                      SHA-512:98C8D149EE74F6F66B92159241F705D9BFB2BB918777BA36CF183D5B7A7A5BC73F0CBB4F55CF9DDE5AF637020B605032F1F7506F02FEACB03C8A66EDB949155F
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:.google.com.TRUE./.FALSE.2597573456.1P_JAR.2023-10-05-12..google.com.TRUE./.FALSE.2597573456.NID.511=mmbjHIW3BhoJp_WlyHkUgqKZXD6pmTuADdoAp_PDxA2xahtsaif4BkKrvmLt4wLjq-7-tV9jZcxMj0sSIltFFvmFpAzc_q0UIMqMpOy-URy1YhAsmGKzZ62a7Pl0LYofsu9x2N5Be-7OSAD_ZTgfoYvoKMStu7thwi0QM0tTIr8.

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\179605\Game\craftrise.txt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):11
                                                                                                                                                      Entropy (8bit):2.186704345910025
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:blVOM:BVj
                                                                                                                                                      MD5:C4E084CD947C96A0B82B02C634540789
                                                                                                                                                      SHA1:DE91618BAF7ECCBAD86A0610176B6BE79E16A094
                                                                                                                                                      SHA-256:C926A5B9148DEECB9084D03187B9297B501296DE20F87DB2B689066C3FBB34D2
                                                                                                                                                      SHA-512:C2D288B2EE229C8EDD1250284322A118B06A847AD05E076F4F028ACD5A060864A4F6DBE77C091707AFF49663E3A6D7C8E173DDC83220C44DF6468C02E7EB7E85
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:Yokki:Yokki

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\179605\Game\sonoyuncu.txt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):11
                                                                                                                                                      Entropy (8bit):2.186704345910025
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:blVOM:BVj
                                                                                                                                                      MD5:C4E084CD947C96A0B82B02C634540789
                                                                                                                                                      SHA1:DE91618BAF7ECCBAD86A0610176B6BE79E16A094
                                                                                                                                                      SHA-256:C926A5B9148DEECB9084D03187B9297B501296DE20F87DB2B689066C3FBB34D2
                                                                                                                                                      SHA-512:C2D288B2EE229C8EDD1250284322A118B06A847AD05E076F4F028ACD5A060864A4F6DBE77C091707AFF49663E3A6D7C8E173DDC83220C44DF6468C02E7EB7E85
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:Yokki:Yokki

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\179605\screenshot.png

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:PNG image data, 1280 x 1024, 8-bit/color RGB, non-interlaced
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):572822
                                                                                                                                                      Entropy (8bit):7.9241520789903
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:12288:PxSmIZc5tB2NZHLcJQwFovdXs4pXhVVeQfnd0lpoHgF7GdoTm:PAmwKaE8vdJpzbnilaHUiX
                                                                                                                                                      MD5:D681BD559F47FDDECFC54EC2432E897F
                                                                                                                                                      SHA1:05DDEDF90606697A1FF6F45DEFF619BF5413F387
                                                                                                                                                      SHA-256:7465EE1A6394FA8DFD62BF6554419DEE2952BB65D786865095F5E1103C35D422
                                                                                                                                                      SHA-512:227590745926C6E2D3E0C7A4AF2083E94D3DA138F4448793EDC495F606A6A4B96952675328680A7EA353C3D6973644B9335F12DC307C52A525840332198A5863
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:.PNG........IHDR.............1.c.....IDATx..y...u.U.7.C..........{.b.g.D.....A.;...B..7.....D..(J.wR\....J\DY...@/..;@. .}k.....B.s2O.[_VUWU/h..q"../.L..~:...y.O.A.1u...-....9.-:.M.g.*...O..O."oa....S..@*i.Xp.h....w.J<y.{.(..o........&.#.).sW.G....9....>.C.....x.PF%.(@...fS.>_.{;..m_...@.%.)@....*.}.)......)Z....UI.....w.N..]...i.....J.N....w..m.......<..mk.-9..N.J..;.Ub...f_.....+..w.R......gV.7..5...3..._y.*....6I.-...}.5o..J.Q.bMi].)....nYO.|a.............V%7...7....Z...x.....Ti.n.5.k..V...8|.Z.K..d.....Be7....>.....:y.j.V..|....;J.CXP.7..f.U.-.~U...9.5{U.u..Y.m.V,.S>w.n..p..9.+........q-..Y.....df[bz...M.h...;P......%.[..@.i......UX....3...%.iNLm.dZK.MPrZc...k.|f+...xZ6..*....0...~....k..5..5oK.iLNYY2.....fJS.K.4@\$'.C%.W.N...J&7B.)n...J'6.LX.......M.n...M,..I.Z@|..q...T>..lB..\.^.29..d|=...S.;..Y9...:..7jybl-.zcjp...&>.M~......*&4T..........IM..i..Zl..n*..P:ve......M...\^5...J..SX..6...x.k......>>.a.\@.....-...

                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\cookies.txt

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:ASCII text
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):273
                                                                                                                                                      Entropy (8bit):5.825524542035742
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:6:Pk3rocHDyzxb6t+3rocHDKJJch1URW6Di7zxJVdGIIn5kT/C:c79EU+79LODyxIn5N
                                                                                                                                                      MD5:3CCFB5196DF424FFC2A0D9B9C6522529
                                                                                                                                                      SHA1:006A97F1810291522345DEB3A435B0F994747BB6
                                                                                                                                                      SHA-256:44EF3C31F63DDFC34F18D4140A9DCB055403B66B3E7B1876D01C6E94BB29F1AE
                                                                                                                                                      SHA-512:98C8D149EE74F6F66B92159241F705D9BFB2BB918777BA36CF183D5B7A7A5BC73F0CBB4F55CF9DDE5AF637020B605032F1F7506F02FEACB03C8A66EDB949155F
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:.google.com.TRUE./.FALSE.2597573456.1P_JAR.2023-10-05-12..google.com.TRUE./.FALSE.2597573456.NID.511=mmbjHIW3BhoJp_WlyHkUgqKZXD6pmTuADdoAp_PDxA2xahtsaif4BkKrvmLt4wLjq-7-tV9jZcxMj0sSIltFFvmFpAzc_q0UIMqMpOy-URy1YhAsmGKzZ62a7Pl0LYofsu9x2N5Be-7OSAD_ZTgfoYvoKMStu7thwi0QM0tTIr8.

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\edge_tempfile.db

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):196608
                                                                                                                                                      Entropy (8bit):1.1220068301579391
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8JoudpfjOLl:aq+n0E9ELyKOMq+8qu3SJ
                                                                                                                                                      MD5:87EE0BBB38B11E14090EF60A7D56C8B1
                                                                                                                                                      SHA1:37966F94007814B687989937B4A299FA816581ED
                                                                                                                                                      SHA-256:22CD1C8F26B721A19A1E9108D16AB419ABAD17D34ACDA62CAE3004014D88437E
                                                                                                                                                      SHA-512:37572D4B5A336BC8220B9CF64F8F2D6041C68A449C582221C5C62A3BA1D8D4CA5C241C9383038EBF3D2787CF4AB9F7370E1A3C4AC7D6EC0A942FC41CD7917266
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\hsperfdata_user\6880

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:data
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):65536
                                                                                                                                                      Entropy (8bit):1.3084151402718946
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:96:e1ANr4NB8GS+i1H80cXcF5KHoxI4M3PKkGSFNHE1zo26:e1Z78GS+cc0csFi4BUfHE5
                                                                                                                                                      MD5:D6507BACD255B32B7519C1BD6A1C61ED
                                                                                                                                                      SHA1:DDCA4A3570B8D2F453B268B412536D68BF85535B
                                                                                                                                                      SHA-256:D5C3BC7560C4FFDF5C8D1DDCCACEF95459D08AD3C19489AB54E53533F286AD6A
                                                                                                                                                      SHA-512:2F8B270291EDDB95713676DA35FF503BCAD8703C54D7B387A7892034EDB7BD7CB62F5052C7724764B5E8E8CDB36CBC791A9FC2681BC2FF5083F0975E4E35ABE0
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:.........9.............. .......8...........J...0...sun.rt._sync_Inflations.....".......8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..h.......@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..`.......8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\jna-92896885\jna3139189163944155017.dll

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):211456
                                                                                                                                                      Entropy (8bit):6.575456249068181
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3072:XsYkXwU8MpSFif9jejzCvjrEt1++W9WCrHudSzoNyLXX4Fv/IK9zFaTsXvXs9G44:XFL/myjzss1++kQCo2XMLvXs9G4q2c
                                                                                                                                                      MD5:E15183EF9C6C255B76FDA73D01CA7ECB
                                                                                                                                                      SHA1:F816F998C43204230D9EA3EECFFB5F8372A32C2E
                                                                                                                                                      SHA-256:38650A0612730C52580C9F32FF766B44B1C5A426D52E7DD7A53687BF3389AC2C
                                                                                                                                                      SHA-512:EC5D7CB3A209C4A1C60BB374755F2809AE892530439FADAB335569BBBF8937DD209F9FAC27393C66371594DAEAD30545F465D25C4DB48CB519BDB50964EF756B
                                                                                                                                                      Malicious:false
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                      • Filename: soinjector.exe, Detection: malicious, Browse
                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!:..@T..@T..@T..(W..@T..(Q.S@T..(P..@T..4Q..@T..4P..@T..4W..@T..(U..@T..@U..@T..4W..@T..@T..@T..4P..@T..4T..@T..4V..@T.Rich.@T.........PE..L....}.c...........!.....N..........?R.......`............................................@.............................T...$...<....@.......................P... ..|...................................@............`..0............................text....M.......N.................. ..`.rdata...|...`...~...R..............@..@.data...\Q.......D..................@....rsrc........@......................@....reloc... ...P..."..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-40faf7a8-eb23-48f9-802d-09995356935d-sqlitejdbc.dll

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):889856
                                                                                                                                                      Entropy (8bit):6.420545484819812
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24576:4h2l/NT2mP8kBDZJMa1DDGITUQYBgouZbU/OMF/0J9Jsz/p0:t7JNtDAfgNEOMF/0Jw
                                                                                                                                                      MD5:5A71D86A23A6CF63244885748D3AF5B8
                                                                                                                                                      SHA1:C5B4B5269B3B5A0B18E0CAB4C07CB0CB136A3AAD
                                                                                                                                                      SHA-256:52A9A1CE0F110563AF4AE34B83A5C256062944CB2B294EEBB05E2568E2AE5977
                                                                                                                                                      SHA-512:118D3D13D592226C4C2F873687FC15245853D1E1140406A31A46B3E60AB7AABBD6B5F2224DDD151F32A7821A48F1C1CAA481D7270E2F673B2E1FCF33A9AB688C
                                                                                                                                                      Malicious:false
                                                                                                                                                      Antivirus:
                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                      • Filename: soinjector.exe, Detection: malicious, Browse
                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#......................... .....e................................O......... ......................`..#....p..l................................E..................................................dr...............................text...............................`.P`.data...|.... ......................@.p..rdata.. ....@.......*..............@.p@.bss....(....P........................p..edata..#....`.......,..............@.0@.idata..l....p.......:..............@.0..CRT....,............J..............@.0..tls.... ............L..............@.0..reloc...E.......F...N..............@.0B........................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\tempfile.db

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):51200
                                                                                                                                                      Entropy (8bit):0.8746135976761988
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\tempfile1.db

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):20480
                                                                                                                                                      Entropy (8bit):0.6732424250451717
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Local\Temp\tempfile2.db

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):40960
                                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

                                                                                                                                                      Download File
                                                                                                                                                      Process:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      File Type:data
                                                                                                                                                      Category:dropped
                                                                                                                                                      Size (bytes):45
                                                                                                                                                      Entropy (8bit):0.9111711733157262
                                                                                                                                                      Encrypted:false
                                                                                                                                                      SSDEEP:3:/lwlt7n:WNn
                                                                                                                                                      MD5:C8366AE350E7019AEFC9D1E6E6A498C6
                                                                                                                                                      SHA1:5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
                                                                                                                                                      SHA-256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
                                                                                                                                                      SHA-512:33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
                                                                                                                                                      Malicious:false
                                                                                                                                                      Preview:........................................J2SE.

                                                                                                                                                      Static File Info

                                                                                                                                                      General

                                                                                                                                                      File type:Java archive data (JAR)
                                                                                                                                                      Entropy (8bit):7.974213977145014
                                                                                                                                                      TrID:
                                                                                                                                                      • Java Archive (13504/1) 62.80%
                                                                                                                                                      • ZIP compressed archive (8000/1) 37.20%
                                                                                                                                                      File name:bZPAo2e2Pv.jar
                                                                                                                                                      File size:14'111'939 bytes
                                                                                                                                                      MD5:0e929dc2d517690e49d95ec4ffeb067b
                                                                                                                                                      SHA1:3793bd95395f32d677ed7877972ee38c1581089a
                                                                                                                                                      SHA256:45cbb31ac832781dcd07ed72c7d947ed9060453b5bbd44b2b8f7955dbc283d9d
                                                                                                                                                      SHA512:ef0d06229f34c798575fa5cdd7d81ad3be772ea1b395a32a853ec99bc9777f4503b9d64d869fe1f27cd2f84c7d1a2a0d197df16d3bb2d4459a50b5cb296bdf13
                                                                                                                                                      SSDEEP:393216:QiFH942jpQGw1jiJyplw7JwO2UkI5LYvFAYmgsDiEt7t8:Qiz4KpQG+mJQlwSO2DvFAvZpJ8
                                                                                                                                                      TLSH:55E612B3BDE1C829E927E0B251C2C562242A22DAE487D17F26E06DE65D71D470353FEC
                                                                                                                                                      File Content Preview:PK..........MY............1...org/apache/commons/codec/language/bm/Rule$1.class.....TmO.`.=W...l....S...(( :@e.N.1bP?..@M.6.F4..d........G......!..nI..g=......_...L.H.....:...+.]*.V....).jmT..]Y+)...>0.....,.....h.........uA.....`.j.0..M.,.......T\....7..

                                                                                                                                                      File Icon

                                                                                                                                                      Icon Hash:d08c8e8ea2868a54

                                                                                                                                                      Network Behavior

                                                                                                                                                      Network Port Distribution

                                                                                                                                                      TCP Packets

                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                      Nov 21, 2024 17:00:23.953025103 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:23.953054905 CET4434971145.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:23.953109980 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:24.136163950 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:24.136193991 CET4434971145.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:25.719933987 CET4434971145.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:25.720000982 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:25.742029905 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:25.742053032 CET4434971145.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:25.793751955 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:25.793777943 CET4434971145.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:25.794037104 CET4434971145.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:25.794090033 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:25.794614077 CET49711443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:25.794630051 CET4434971145.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:37.510881901 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:37.510935068 CET44349717149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:37.511003017 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:37.516153097 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:37.516166925 CET44349717149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:38.931143045 CET44349717149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:38.931267023 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:38.991008997 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:38.991038084 CET44349717149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:39.040963888 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:39.040987015 CET44349717149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:39.041274071 CET44349717149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:39.041368008 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:39.041620016 CET49717443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:39.041635036 CET44349717149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:39.375088930 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:39.375157118 CET4434971845.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:39.375221968 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:39.379144907 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:39.379175901 CET4434971845.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:40.806381941 CET4434971845.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:40.806509972 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:40.811518908 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:40.811532021 CET4434971845.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:40.814616919 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:40.814620972 CET4434971845.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:40.814836979 CET4434971845.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:40.814894915 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:40.814974070 CET49718443192.168.2.1245.112.123.126
                                                                                                                                                      Nov 21, 2024 17:00:40.814986944 CET4434971845.112.123.126192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:43.141391039 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:43.141431093 CET44349719149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:43.141496897 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:43.144918919 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:43.144948959 CET44349719149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:44.573455095 CET44349719149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:44.573566914 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:44.598511934 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:44.598553896 CET44349719149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:44.646683931 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:44.646712065 CET44349719149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:44.647013903 CET44349719149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:44.647165060 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:44.647176981 CET44349719149.154.167.220192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:44.647206068 CET49719443192.168.2.12149.154.167.220
                                                                                                                                                      Nov 21, 2024 17:00:45.170500994 CET49720443192.168.2.1220.233.83.145
                                                                                                                                                      Nov 21, 2024 17:00:45.170551062 CET4434972020.233.83.145192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:45.170661926 CET49720443192.168.2.1220.233.83.145
                                                                                                                                                      Nov 21, 2024 17:00:45.181850910 CET49720443192.168.2.1220.233.83.145
                                                                                                                                                      Nov 21, 2024 17:00:45.181868076 CET4434972020.233.83.145192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:46.917960882 CET4434972020.233.83.145192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:46.918111086 CET49720443192.168.2.1220.233.83.145
                                                                                                                                                      Nov 21, 2024 17:00:46.923352957 CET49720443192.168.2.1220.233.83.145
                                                                                                                                                      Nov 21, 2024 17:00:46.923377037 CET4434972020.233.83.145192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:46.927007914 CET49720443192.168.2.1220.233.83.145
                                                                                                                                                      Nov 21, 2024 17:00:46.927018881 CET4434972020.233.83.145192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:46.927345037 CET4434972020.233.83.145192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:46.927371979 CET49720443192.168.2.1220.233.83.145
                                                                                                                                                      Nov 21, 2024 17:00:46.927388906 CET4434972020.233.83.145192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:46.927419901 CET49720443192.168.2.1220.233.83.145

                                                                                                                                                      UDP Packets

                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                      Nov 21, 2024 17:00:23.800260067 CET5561853192.168.2.121.1.1.1
                                                                                                                                                      Nov 21, 2024 17:00:23.948230028 CET53556181.1.1.1192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:26.108284950 CET5023853192.168.2.121.1.1.1
                                                                                                                                                      Nov 21, 2024 17:00:26.477524042 CET53502381.1.1.1192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:37.364867926 CET5292953192.168.2.121.1.1.1
                                                                                                                                                      Nov 21, 2024 17:00:37.507278919 CET53529291.1.1.1192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:39.043621063 CET5999353192.168.2.121.1.1.1
                                                                                                                                                      Nov 21, 2024 17:00:39.201754093 CET53599931.1.1.1192.168.2.12
                                                                                                                                                      Nov 21, 2024 17:00:45.002383947 CET5482353192.168.2.121.1.1.1
                                                                                                                                                      Nov 21, 2024 17:00:45.142535925 CET53548231.1.1.1192.168.2.12

                                                                                                                                                      DNS Queries

                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                      Nov 21, 2024 17:00:23.800260067 CET192.168.2.121.1.1.10x8b4fStandard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:26.108284950 CET192.168.2.121.1.1.10xc496Standard query (0)canstlr.xyzA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:37.364867926 CET192.168.2.121.1.1.10xc1c4Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:39.043621063 CET192.168.2.121.1.1.10x167Standard query (0)canstlr.xyzA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:45.002383947 CET192.168.2.121.1.1.10xdb9eStandard query (0)github.comA (IP address)IN (0x0001)false

                                                                                                                                                      DNS Answers

                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                      Nov 21, 2024 17:00:23.948230028 CET1.1.1.1192.168.2.120x8b4fNo error (0)api.gofile.io45.112.123.126A (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:26.477524042 CET1.1.1.1192.168.2.120xc496Name error (3)canstlr.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:37.507278919 CET1.1.1.1192.168.2.120xc1c4No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:39.201754093 CET1.1.1.1192.168.2.120x167Name error (3)canstlr.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                      Nov 21, 2024 17:00:45.142535925 CET1.1.1.1192.168.2.120xdb9eNo error (0)github.com20.233.83.145A (IP address)IN (0x0001)false

                                                                                                                                                      Statistics

                                                                                                                                                      CPU Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      Memory Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                      Behavior

                                                                                                                                                      Click to jump to process

                                                                                                                                                      System Behavior

                                                                                                                                                      General

                                                                                                                                                      Target ID:0
                                                                                                                                                      Start time:11:00:16
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar"" >> C:\cmdlinestart.log 2>&1
                                                                                                                                                      Imagebase:0x1f0000
                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:1
                                                                                                                                                      Start time:11:00:16
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:2
                                                                                                                                                      Start time:11:00:16
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\bZPAo2e2Pv.jar"
                                                                                                                                                      Imagebase:0x4b0000
                                                                                                                                                      File size:257'664 bytes
                                                                                                                                                      MD5 hash:9DAA53BAB2ECB33DC0D9CA51552701FA
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Yara matches:
                                                                                                                                                      • Rule: JoeSecurity_CanStealer, Description: Yara detected Can Stealer, Source: 00000002.00000002.2659859380.00000000165E4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      • Rule: JoeSecurity_CanStealer, Description: Yara detected Can Stealer, Source: 00000002.00000002.2654014012.000000000AA1B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:3
                                                                                                                                                      Start time:11:00:17
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
                                                                                                                                                      Imagebase:0x770000
                                                                                                                                                      File size:29'696 bytes
                                                                                                                                                      MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:4
                                                                                                                                                      Start time:11:00:17
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:5
                                                                                                                                                      Start time:11:00:17
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:tasklist
                                                                                                                                                      Imagebase:0x620000
                                                                                                                                                      File size:79'360 bytes
                                                                                                                                                      MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:6
                                                                                                                                                      Start time:11:00:17
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:7
                                                                                                                                                      Start time:11:00:21
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:8
                                                                                                                                                      Start time:11:00:21
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:9
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:10
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:high
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:11
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:12
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:13
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:14
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:15
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:16
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:17
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:18
                                                                                                                                                      Start time:11:00:22
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:19
                                                                                                                                                      Start time:11:00:25
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:20
                                                                                                                                                      Start time:11:00:25
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:21
                                                                                                                                                      Start time:11:00:25
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:22
                                                                                                                                                      Start time:11:00:25
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:23
                                                                                                                                                      Start time:11:00:25
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:24
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:25
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:26
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:27
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:28
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:29
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:30
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:31
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:32
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:33
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:34
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:35
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:36
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:37
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:38
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:39
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:wmic path win32_VideoController get name
                                                                                                                                                      Imagebase:0x810000
                                                                                                                                                      File size:427'008 bytes
                                                                                                                                                      MD5 hash:E2DE6500DE1148C7F6027AD50AC8B891
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:40
                                                                                                                                                      Start time:11:00:26
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:41
                                                                                                                                                      Start time:11:00:28
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:wmic cpu get name
                                                                                                                                                      Imagebase:0x810000
                                                                                                                                                      File size:427'008 bytes
                                                                                                                                                      MD5 hash:E2DE6500DE1148C7F6027AD50AC8B891
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:42
                                                                                                                                                      Start time:11:00:28
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:45
                                                                                                                                                      Start time:11:00:30
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:wmic os get Caption /value
                                                                                                                                                      Imagebase:0x810000
                                                                                                                                                      File size:427'008 bytes
                                                                                                                                                      MD5 hash:E2DE6500DE1148C7F6027AD50AC8B891
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:46
                                                                                                                                                      Start time:11:00:30
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:47
                                                                                                                                                      Start time:11:00:31
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:48
                                                                                                                                                      Start time:11:00:31
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:49
                                                                                                                                                      Start time:11:00:32
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:50
                                                                                                                                                      Start time:11:00:32
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:51
                                                                                                                                                      Start time:11:00:32
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:wmic path win32_VideoController get name
                                                                                                                                                      Imagebase:0x810000
                                                                                                                                                      File size:427'008 bytes
                                                                                                                                                      MD5 hash:E2DE6500DE1148C7F6027AD50AC8B891
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:52
                                                                                                                                                      Start time:11:00:32
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:53
                                                                                                                                                      Start time:11:00:33
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:wmic cpu get name
                                                                                                                                                      Imagebase:0x810000
                                                                                                                                                      File size:427'008 bytes
                                                                                                                                                      MD5 hash:E2DE6500DE1148C7F6027AD50AC8B891
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:54
                                                                                                                                                      Start time:11:00:33
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:55
                                                                                                                                                      Start time:11:00:35
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:wmic os get Caption /value
                                                                                                                                                      Imagebase:0x810000
                                                                                                                                                      File size:427'008 bytes
                                                                                                                                                      MD5 hash:E2DE6500DE1148C7F6027AD50AC8B891
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:56
                                                                                                                                                      Start time:11:00:35
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:57
                                                                                                                                                      Start time:11:00:38
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:58
                                                                                                                                                      Start time:11:00:38
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:59
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:60
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0xb0000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:61
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:62
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:63
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:64
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:65
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:66
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:67
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0x7ff6d82a0000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:68
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:69
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:70
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:71
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:72
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:73
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:74
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:75
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:76
                                                                                                                                                      Start time:11:00:40
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:77
                                                                                                                                                      Start time:11:00:41
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\SysWOW64\HOSTNAME.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:hostname
                                                                                                                                                      Imagebase:0xb50000
                                                                                                                                                      File size:11'776 bytes
                                                                                                                                                      MD5 hash:B1C51FED46434CF91E65C7B605F8EF3A
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      General

                                                                                                                                                      Target ID:78
                                                                                                                                                      Start time:11:00:41
                                                                                                                                                      Start date:21/11/2024
                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      Imagebase:0x7ff704000000
                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Has exited:true

                                                                                                                                                      Disassembly

                                                                                                                                                      Reset < >

                                                                                                                                                        Non-executed Functions

                                                                                                                                                        Function 16965F74 Relevance: .5, Instructions: 465COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000002.00000003.2398119230.000000001695E000.00000004.00000020.00020000.00000000.sdmp, Offset: 1695E000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_2_3_1691e000_java.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: bdb7f6f68cc251e6e7a7dbc0ca507d0ba8fb7c57c965ea9937672e56bbe29a23
                                                                                                                                                        • Instruction ID: a0a1349432aa3b5a8cac4b3f5c881e7fad2275a54d3ad646886c9f949f04340e
                                                                                                                                                        • Opcode Fuzzy Hash: bdb7f6f68cc251e6e7a7dbc0ca507d0ba8fb7c57c965ea9937672e56bbe29a23
                                                                                                                                                        • Instruction Fuzzy Hash: 0E02B4729053A69FD715CF28D8C52C9FFF6FE31628729648ED091CA217E321612ACF85
                                                                                                                                                        Function 16965C10 Relevance: .2, Instructions: 201COMMON
                                                                                                                                                        Download Yara Rule
                                                                                                                                                        Memory Dump Source
                                                                                                                                                        • Source File: 00000002.00000003.2398119230.000000001695E000.00000004.00000020.00020000.00000000.sdmp, Offset: 1695E000, based on PE: false
                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                        • Snapshot File: hcaresult_2_3_1691e000_java.jbxd
                                                                                                                                                        Similarity
                                                                                                                                                        • API ID:
                                                                                                                                                        • String ID:
                                                                                                                                                        • API String ID:
                                                                                                                                                        • Opcode ID: f2e4b1d3342a36ed9c611ef8c779e6035526307d5137abe2b18ffa86d188a753
                                                                                                                                                        • Instruction ID: 56140c72e1fe6546e0fc884a5489670e31d961230776026287af52dbbc4707b7
                                                                                                                                                        • Opcode Fuzzy Hash: f2e4b1d3342a36ed9c611ef8c779e6035526307d5137abe2b18ffa86d188a753
                                                                                                                                                        • Instruction Fuzzy Hash: 1971D1315052929FD3069F28D8C53C5FFF7FE3A218729759AD4A1CB222F3612029CB84