Edit tour

Windows Analysis Report
Shipping Bill No6239999Dt09122024.PDF.jar

Overview

General Information

Sample name:	Shipping Bill No6239999Dt09122024.PDF.jar
Analysis ID:	1576666
MD5:	fb02745de7ec057a90b207602e732be6
SHA1:	c1ecc13f6f7b8043918cc17a4fb88fb29c6ba9d0
SHA256:	84481aed848a500ec03fb0e95443a125eac073999aaf8391e221f72f75a33cb0
Tags:	evilginx-misecure-comjaruser-JAMESWT_MHT
Infos:

Detection

Caesium Obfuscator, STRRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Caesium Obfuscator

Yara detected STRRAT

Creates autostart registry keys to launch java

Exploit detected, runtime environment starts unknown processes

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Startup Folder Persistence

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Shell Process Spawned by Java.EXE

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7za.exe (PID: 4956 cmdline: 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\Shipping Bill No6239999Dt09122024.PDF.jar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 396 cmdline: java.exe -jar "C:\Users\user\Desktop\Shipping Bill No6239999Dt09122024.PDF.jar" kingDavid.FirstRun MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 1448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 744 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5000 cmdline: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3152 cmdline: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar" MD5: 48C2FE20575769DE916F48EF0676A965)

java.exe (PID: 3744 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar" MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6976 cmdline: cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3488 cmdline: wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 744 cmdline: cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1448 cmdline: wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 5544 cmdline: cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3152 cmdline: wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 1196 cmdline: cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 732 cmdline: wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list MD5: E2DE6500DE1148C7F6027AD50AC8B891)

javaw.exe (PID: 4544 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

javaw.exe (PID: 4596 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

javaw.exe (PID: 4320 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

cleanup

Malware Configuration

Threatname: STRRAT

{"C2 list": "evilginx.misecure.com:1790", "url": "http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5", "Proxy": "evilginx.misecure.com:1790", "lid": "RKA0-KES0-EPPK-UDRO-JNCG", "Startup": "true", "Secondary Startup": "true", "Scheduled Task": "true"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\jar\META-INF\MANIFEST.MF	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1713177823.0000000002F60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001B.00000003.2001658470.0000000001615000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000007.00000003.1728437363.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001C.00000003.2083062525.00000000014E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000002.00000002.1729710613.0000000009A29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001C.00000002.2962223596.000000000A627000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000017.00000002.2962128496.000000000A228000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000007.00000002.2961944320.0000000009E28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000002.00000003.1714483688.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
0000001C.00000002.2962223596.000000000A596000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000017.00000003.1844452207.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
0000001B.00000002.2962620921.000000000A628000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: 7za.exe PID: 4956	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: java.exe PID: 396	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: java.exe PID: 396	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: java.exe PID: 3744	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: java.exe PID: 3744	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: javaw.exe PID: 4544	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: javaw.exe PID: 4544	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: javaw.exe PID: 4596	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: javaw.exe PID: 4596	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: javaw.exe PID: 4320	JoeSecurity_CaesiumObfuscator	Yara detected Caesium Obfuscator	Joe Security
Process Memory Space: javaw.exe PID: 4320	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Click to see the 27 entries

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\SysWOW64\wbem\WMIC.exe, SourceProcessId: 1448, StartAddress: 7574D700, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 1448

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ProcessId: 396, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ProcessId: 396, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Bill No6239999Dt09122024.PDF

Sigma detected: Shell Process Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali: Data: Command: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", CommandLine: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: java.exe -jar "C:\Users\user\Desktop\Shipping Bill No6239999Dt09122024.PDF.jar" kingDavid.FirstRun, ParentImage: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ParentProcessId: 396, ParentProcessName: java.exe, ProcessCommandLine: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", ProcessId: 5000, ProcessName: cmd.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ProcessId: 396, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", CommandLine: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5000, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar", ProcessId: 3152, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE STRRAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T11:51:38.196132+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:43.219750+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:48.220613+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:53.219771+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:58.224198+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:03.222223+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:08.235827+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:13.250679+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:18.250768+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:23.255917+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:28.250575+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:33.266150+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:38.282232+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:43.297696+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:48.297840+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:53.313456+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:58.331363+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:03.344829+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:08.344781+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:13.409267+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:18.360532+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:23.376397+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:23.677391+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:28.376446+0100	2030358	1	Malware Command and Control Activity Detected	192.168.2.4	49730	194.59.30.164	1790	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Shipping Bill No6239999Dt09122024.PDF.jar

Malware Configuration Extractor: STRRAT {"C2 list": "evilginx.misecure.com:1790", "url": "http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5", "Proxy": "evilginx.misecure.com:1790", "lid": "RKA0-KES0-EPPK-UDRO-JNCG", "Startup": "true", "Secondary Startup": "true", "Scheduled Task": "true"}

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\System32\conhost.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2030358 - Severity 1 - ET MALWARE STRRAT CnC Checkin : 192.168.2.4:49730 -> 194.59.30.164:1790

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 194.59.30.164:1790

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: COMBAHTONcombahtonGmbHDE COMBAHTONcombahtonGmbHDE

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Connection: close

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: evilginx.misecure.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: java.exe, 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A1F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A5F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000002.00000002.1731653818.000000001501D000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000003.2336753967.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000003.1780944648.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2965648359.00000000152DF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2966032991.0000000015686000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000003.1897867124.000000001567F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2967400726.0000000015BCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054190560.0000000015BC4000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2965342290.0000000015A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A1F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A5F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A1F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A5F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009A09000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009E01000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A201000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A601000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000002.00000002.1731653818.000000001501D000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000003.2336753967.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000003.1780944648.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2965648359.00000000152DF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2966032991.0000000015686000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000003.1897867124.000000001567F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2967400726.0000000015BCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054190560.0000000015BC4000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2965342290.0000000015A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009A09000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009E01000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A201000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A601000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009A09000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009E08000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A208000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A608000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000002.00000002.1731653818.000000001501D000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000003.2336753967.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000003.1780944648.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2965648359.00000000152DF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2966032991.0000000015686000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000003.1897867124.000000001567F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2967400726.0000000015BCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054190560.0000000015BC4000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2965342290.0000000015A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: javaw.exe, 0000001C.00000002.2960089179.00000000053BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Source: java.exe, 00000002.00000002.1728993317.00000000047BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5;
Source: java.exe, 00000002.00000002.1731653818.0000000015076000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009B0E000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000003.1781154694.00000000152AE000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2965495546.00000000152B5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000003.2336982362.00000000152AE000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009F0A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2965753181.0000000015658000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2959946946.000000000504E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054329371.0000000015C03000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054190560.0000000015BE2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2959519795.000000000544E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2967585532.0000000015C0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2960089179.000000000544F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000002.00000002.1728993317.0000000004805000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/S
Source: java.exe, 00000002.00000002.1729710613.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009DF8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A1F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A5F8000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000002.00000002.1731653818.000000001501D000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000003.2336753967.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000003.1780944648.00000000152D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2965648359.00000000152DF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2966032991.0000000015686000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000003.1897867124.000000001567F000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2967400726.0000000015BCB000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054190560.0000000015BC4000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2965342290.0000000015A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X

Source: classification engine

Classification label: mal100.troj.expl.evad.winJAR@38/129@2/2

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\1790lock.file

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1448:120:WilError_03
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\Shipping Bill No6239999Dt09122024.PDF.jar"
Source: C:\Windows\System32\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Desktop\Shipping Bill No6239999Dt09122024.PDF.jar" kingDavid.FirstRun
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar"
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list	Jump to behavior

Source: C:\Windows\System32\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: dnsapi.dll

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Data Obfuscation

Yara detected Caesium Obfuscator

Source: Yara match	File source: 00000000.00000003.1713177823.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2001658470.0000000001615000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1728437363.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2083062525.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1729710613.0000000009A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2962223596.000000000A627000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2962128496.000000000A228000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2961944320.0000000009E28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1714483688.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2962223596.000000000A596000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1844452207.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2962620921.000000000A628000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7za.exe PID: 4956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: java.exe PID: 396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: java.exe PID: 3744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4320, type: MEMORYSTR
Source: Yara match	File source: C:\jar\META-INF\MANIFEST.MF, type: DROPPED

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0235A21B push ecx; ret	2_2_0235A225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0235A20A push ecx; ret	2_2_0235A21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0235BB67 push 00000000h; mov dword ptr [esp], esp	2_2_0235BB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0235B3B7 push 00000000h; mov dword ptr [esp], esp	2_2_0235B3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0235B947 push 00000000h; mov dword ptr [esp], esp	2_2_0235B96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 2_2_0235C477 push 00000000h; mov dword ptr [esp], esp	2_2_0235C49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_02678A11 push cs; retf	7_2_02678A31
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_026810A3 push edi; retf	7_2_026810A6
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_0267ED98 push cs; ret	7_2_0267EDE1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_025DA21B push ecx; ret	7_2_025DA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_025DA20A push ecx; ret	7_2_025DA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_025DBB67 push 00000000h; mov dword ptr [esp], esp	7_2_025DBB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_025DB3B7 push 00000000h; mov dword ptr [esp], esp	7_2_025DB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_025DB947 push 00000000h; mov dword ptr [esp], esp	7_2_025DB96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 7_2_025DC477 push 00000000h; mov dword ptr [esp], esp	7_2_025DC49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 23_2_029CA21B push ecx; ret	23_2_029CA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 23_2_029CA20A push ecx; ret	23_2_029CA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 23_2_029CB3B7 push 00000000h; mov dword ptr [esp], esp	23_2_029CB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 23_2_029CBB67 push 00000000h; mov dword ptr [esp], esp	23_2_029CBB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 23_2_029CB947 push 00000000h; mov dword ptr [esp], esp	23_2_029CB96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 23_2_029CC477 push 00000000h; mov dword ptr [esp], esp	23_2_029CC49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 27_2_02ECA20A push ecx; ret	27_2_02ECA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 27_2_02ECA21B push ecx; ret	27_2_02ECA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 27_2_02ECB3B7 push 00000000h; mov dword ptr [esp], esp	27_2_02ECB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 27_2_02ECBB67 push 00000000h; mov dword ptr [esp], esp	27_2_02ECBB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 27_2_02ECB947 push 00000000h; mov dword ptr [esp], esp	27_2_02ECB96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 27_2_02ECC477 push 00000000h; mov dword ptr [esp], esp	27_2_02ECC49D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 28_2_02DEA21B push ecx; ret	28_2_02DEA225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 28_2_02DEA20A push ecx; ret	28_2_02DEA21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 28_2_02DEB3B7 push 00000000h; mov dword ptr [esp], esp	28_2_02DEB3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 28_2_02DEBB67 push 00000000h; mov dword ptr [esp], esp	28_2_02DEBB8D

Boot Survival

Creates autostart registry keys to launch java

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Shipping Bill No6239999Dt09122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Shipping Bill No6239999Dt09122024.PDF.jar			Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Shipping Bill No6239999Dt09122024.PDF			Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Shipping Bill No6239999Dt09122024.PDF			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.jar

Static PE information: Shipping Bill No6239999Dt09122024.PDF.jar

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT VolumeSerialNumber FROM win32_logicaldisk

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Code function: 7_2_0267E406 sldt cx

7_2_0267E406

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: javaw.exe, 0000001B.00000003.2002389860.00000000154C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.1728092697.000000000079B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>Lr
Source: javaw.exe, 0000001B.00000003.2002389860.00000000154C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.1728092697.000000000079B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2958304474.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2958376639.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2958346074.0000000001630000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2958432811.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: javaw.exe, 0000001B.00000003.2002389860.00000000154C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000002.1728092697.000000000079B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2958304474.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2958376639.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2958346074.0000000001630000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2958432811.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 00000002.00000003.1715778985.0000000014957000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000003.1729205007.0000000014C67000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000003.1845180062.0000000015064000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2002389860.00000000154C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 00000007.00000002.2958304474.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2958376639.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2958346074.0000000001608000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2958432811.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 2_2_023503C0 cpuid

2_2_023503C0

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\396 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\3744 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\4544 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\4596 VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\4320 VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\1790lock.file VolumeInformation

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : SELECT displayName FROM antivirusproduct

Stealing of Sensitive Information

Yara detected STRRAT

Source: Yara match	File source: 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: java.exe PID: 3744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4320, type: MEMORYSTR

Remote Access Functionality

Yara detected STRRAT

Source: Yara match	File source: 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: java.exe PID: 3744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4320, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Services File Permissions Weakness	121 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Services File Permissions Weakness	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	11 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipping Bill No6239999Dt09122024.PDF.jar	8%	ReversingLabs	ByteCode-JAVA.Spyware.Generic

Source	Detection	Scanner	Label	Link
http://null.oracle.com/	0%	Avira URL Cloud	safe
http://null.oracle.com/S	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
evilginx.misecure.com	194.59.30.164	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://java.oracle.com/	java.exe, 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp	false		high
http://null.oracle.com/	java.exe, 00000002.00000002.1731653818.0000000015076000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.1729710613.0000000009B0E000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000003.1781154694.00000000152AE000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2965495546.00000000152B5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000003.2336982362.00000000152AE000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009F0A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2965753181.0000000015658000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2959946946.000000000504E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054329371.0000000015C03000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000003.2054190560.0000000015BE2000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2959519795.000000000544E000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2967585532.0000000015C0A000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2960089179.000000000544F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5;	java.exe, 00000002.00000002.1728993317.00000000047BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5	javaw.exe, 0000001C.00000002.2960089179.00000000053BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://null.oracle.com/S	java.exe, 00000002.00000002.1728993317.0000000004805000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreport.sun.com/bugreport/	java.exe, 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.59.30.164	evilginx.misecure.com	Germany		30823	COMBAHTONcombahtonGmbHDE	true
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576666
Start date and time:	2024-12-17 11:50:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Tracing
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shipping Bill No6239999Dt09122024.PDF.jar
Detection:	MAL
Classification:	mal100.troj.expl.evad.winJAR@38/129@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 54 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .jar

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target java.exe, PID 3744 because it is empty
Execution Graph export aborted for target java.exe, PID 396 because it is empty
Execution Graph export aborted for target javaw.exe, PID 4320 because it is empty
Execution Graph export aborted for target javaw.exe, PID 4544 because it is empty
Execution Graph export aborted for target javaw.exe, PID 4596 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Shipping Bill No6239999Dt09122024.PDF.jar

Simulations

Behavior and APIs

Time	Type	Description
05:51:30	API Interceptor	4x Sleep call for process: WMIC.exe modified
10:51:28	Task Scheduler	Run new task: Skype path: C:\Users\user\AppData\Roaming\Shipping s>Bill No6239999Dt09122024.PDF.jar
10:51:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Shipping Bill No6239999Dt09122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
10:51:39	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Shipping Bill No6239999Dt09122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
10:51:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Shipping Bill No6239999Dt09122024.PDF "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
10:51:55	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.59.30.164	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse
208.95.112.1	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Creal.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	msedge.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	imagelogger.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	NJRAT DANGEROUS.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	com surrogate.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
evilginx.misecure.com	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
ip-api.com	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	msedge.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	imagelogger.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	NJRAT DANGEROUS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMBAHTONcombahtonGmbHDE	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
	Support.ClientSetup.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.27
	Counseling_Services_Overview.docm	Get hash	malicious	Unknown	Browse	45.147.231.195
	Nowe zam#U00f3wienie - 0072291855.pdf (243KB).com.exe	Get hash	malicious	Quasar	Browse	194.59.31.75
	https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.199
	https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.199
	firestub.bat	Get hash	malicious	Unknown	Browse	194.59.30.10
	Cotizaci#U00f3n 99026475526_pdf.com.exe	Get hash	malicious	Quasar	Browse	194.59.31.75
	file.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.222
TUT-ASUS	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	msedge.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	imagelogger.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	NJRAT DANGEROUS.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	201515
Entropy (8bit):	7.8909723601756
Encrypted:	false
SSDEEP:	3072:KROA9tsCGC9tChoYvQlzwVa37ZGfteVTzg4U5N0iVfG6lfAANinzk4U86vLiy:I9aLC9EjYrrZGfteVTyjn12ANmo4Jy
MD5:	FB02745DE7EC057A90B207602E732BE6
SHA1:	C1ECC13F6F7B8043918CC17A4FB88FB29C6BA9D0
SHA-256:	84481AED848A500EC03FB0E95443A125EAC073999AAF8391E221F72F75A33CB0
SHA-512:	5E3C21BBA3CC652BACB2B32187D62682F441F2E484386C850372DFB39CF2ADCE3B092DD4AA418BC7AA913F0F3A9527E68CABBE9A93158EFD5AE3B997D05FAA2E
Malicious:	true
Preview:	PK.........n.Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[...2.$...71..r..,..t.b.1....>.......7.kG..4....{.....#..V..&7;V.%.........1.wy.gl..d..f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^.FQ#..R.... .....C/..z..b.2..C.m."....4.CR......&hD..n.d.IU....0).<..8.)....e.......#A.7}2......."n0.{...J*..\|......nbN.../p.....'..5......D.M!.m.e9...'..T_G.....(.........cp.(..1..H..j...R.$.......N...;.@...A..........6.R..u..e..i.;E.)1..v.o...3.a....I=F5.......<!.q..U.I..:.s....T.J.3.....O^{...!.I},....3.....@..0..(....3.]z?.....C.'zu..Z.Yr....gh.&dx@~....e....BG.`...PK.....bH...;...PK.........n.Y............"...kingDavid/k.class/caesium_27.classc..PK..............PK.........n.Y............"...kingDavid/k.class/caesium_26.classc..PK..............PK.........n.Y............"...kingDavid/k.class/caesium_25.classc..PK..............PK.........n.Y................kingDavid/b.class/.{wtUE.......u........^.."(.6..(...B........`W...+..P.

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.873140679513134
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USRUWVyn:oJ5bRU
MD5:	2EB9DD4066CA4FF56C7FC68267331623
SHA1:	CB084C1AF3982142F7391DEBF768381AA560E3A3
SHA-256:	90C9FFEE2401E8FAF2E298B268FCE2842D6DE5310084E2ED29D0E09CD630955B
SHA-512:	3A04019417F8CC2DC61C40CC07873E112E744B1217BD6BC660616A6BC057918C59FA004473817ED292D5822B4D840948DD8E1C111244E30C8B44DD64CAD2E5AF
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre-1.8..1734432723440..

C:\Users\user\AppData\Local\Temp\hsperfdata_user\3744

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2869043582032993
Encrypted:	false
SSDEEP:	96:r9hrwV08G43RtdgG6KANv3gz6hYSTxPHG1bowHe:r9V8G4RtdJ6jwzupHGd
MD5:	9300AD1C674B2343897F09EEF11A61C8
SHA1:	02FB7F91AF17384B10A38A6A4AE1F4967F1F5674
SHA-256:	0E958A36E3AB01C39B662D33B013C8021AA794DBF8A12B89E0DA9AD49FE3E766
SHA-512:	AA1B9F59A4256E4E102597E066208239D5B4F27630895760697181373DB148E57ABB66530330FF9488BA3667C82302DAB7FC23AB38C0D221EB26E2DB754D7AC7
Malicious:	false
Preview:	........(9.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\396

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2899874203024075
Encrypted:	false
SSDEEP:	96:ViwaVru+8G5XL3U8tXK6SGFWvEIPt7J7TxPHG1bowI+:0w68G5XL3U8tXK6hIFJZHGd
MD5:	FD686E81A68B9593805BDDB25342FE62
SHA1:	1075FFBF319A0F8C773BCF2ED3B11427332A2567
SHA-256:	BBF632B3E295959E48C71BC3E37ECA51478845B7E58AEC504E36E553F85C56A9
SHA-512:	0C34A7256478970716C47D26826F7AEF15BE12266E93514ADC96D7857B6150967244AA1F1BECEEB11D1DBD806CCEC461E2E26E6856CBAF2E8ADAABA19D623B62
Malicious:	false
Preview:	........@9.......H)..... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4320

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2967281786162876
Encrypted:	false
SSDEEP:	96:UwCr0U8G5IMrDV6E0wtgYtiSTI4vHG1bowO4+6:Uw+8GOMrDV6bYjLHGd
MD5:	C03FD33C9BE43B8CC321BBA51F6312AD
SHA1:	9A2B469BAD3557426CB90DAB187E3DED6DDD791E
SHA-256:	BF7DE1D4A90994C6EACD43A50224D4728720CFEBF49B8EE23820A22B2C960259
SHA-512:	987B0C36F34A507CF0FBF4C69A3C8EB9D296B28F34714301FEB42EF11121D02B98E7B7DED6DFF11B90BDD3D186C7E12291FD9A247A545CAFB8A27683307A8807
Malicious:	false
Preview:	.........9......%}...... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4544

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2855459423236868
Encrypted:	false
SSDEEP:	96:NwGrEi8G9fxAzmV6ohweegQOd1STxPHG1bowHe:Nww8G9ZAzmV6o5Q7pHGd
MD5:	23EEE9AB3AA9BEED6236F80A7678CCB7
SHA1:	3656C65AE31329F95AB8274811D08E5ACCE63E22
SHA-256:	27B021EF1E8DD176BC34913E253A225CF9CF63CA414131AFD8ED6B75F6898758
SHA-512:	65B124ED88399D3CB62F02169BA92B26BB1CB6A7F46FB622DD335AFBD8522409282CE1F000F13168A2BC88B5367B9CF58FADCE4060F5CEF64FFC48B1468202ED
Malicious:	false
Preview:	........(9.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4596

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2858711222009
Encrypted:	false
SSDEEP:	96:/wGrdzt8GcCLHV6pmwdDgQwQLSTxPHG1bowHeK:/wut8GcCLHV61UQ0pHGd
MD5:	99360EEE6B152A9C0E79DEDB6DE84830
SHA1:	0D197EE76C7A1A4D1DCECD3BC8D06946761C7B0E
SHA-256:	B8BE48E8EC9B92B1E219CA8EC1C8AF218A0DB74B0D29DD485404785918D91B94
SHA-512:	DE396AA1F4E841441ED57A5F1C594B22F7D4DE7C994029F9A6360545DB4A4B46CBD8C659BB350BA132D0AA9C78EB8BA21188936D9C0476F643FD357289CADF29
Malicious:	false
Preview:	........(9.......R...... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	201515
Entropy (8bit):	7.8909723601756
Encrypted:	false
SSDEEP:	3072:KROA9tsCGC9tChoYvQlzwVa37ZGfteVTzg4U5N0iVfG6lfAANinzk4U86vLiy:I9aLC9EjYrrZGfteVTyjn12ANmo4Jy
MD5:	FB02745DE7EC057A90B207602E732BE6
SHA1:	C1ECC13F6F7B8043918CC17A4FB88FB29C6BA9D0
SHA-256:	84481AED848A500EC03FB0E95443A125EAC073999AAF8391E221F72F75A33CB0
SHA-512:	5E3C21BBA3CC652BACB2B32187D62682F441F2E484386C850372DFB39CF2ADCE3B092DD4AA418BC7AA913F0F3A9527E68CABBE9A93158EFD5AE3B997D05FAA2E
Malicious:	true
Preview:	PK.........n.Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[...2.$...71..r..,..t.b.1....>.......7.kG..4....{.....#..V..&7;V.%.........1.wy.gl..d..f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^.FQ#..R.... .....C/..z..b.2..C.m."....4.CR......&hD..n.d.IU....0).<..8.)....e.......#A.7}2......."n0.{...J*..\|......nbN.../p.....'..5......D.M!.m.e9...'..T_G.....(.........cp.(..1..H..j...R.$.......N...;.@...A..........6.R..u..e..i.;E.)1..v.o...3.a....I=F5.......<!.q..U.I..:.s....T.J.3.....O^{...!.I},....3.....@..0..(....3.]z?.....C.'zu..Z.Yr....gh.&dx@~....e....BG.`...PK.....bH...;...PK.........n.Y............"...kingDavid/k.class/caesium_27.classc..PK..............PK.........n.Y............"...kingDavid/k.class/caesium_26.classc..PK..............PK.........n.Y............"...kingDavid/k.class/caesium_25.classc..PK..............PK.........n.Y................kingDavid/b.class/.{wtUE.......u........^.."(.6..(...B........`W...+..P.

C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	201515
Entropy (8bit):	7.8909723601756
Encrypted:	false
SSDEEP:	3072:KROA9tsCGC9tChoYvQlzwVa37ZGfteVTzg4U5N0iVfG6lfAANinzk4U86vLiy:I9aLC9EjYrrZGfteVTyjn12ANmo4Jy
MD5:	FB02745DE7EC057A90B207602E732BE6
SHA1:	C1ECC13F6F7B8043918CC17A4FB88FB29C6BA9D0
SHA-256:	84481AED848A500EC03FB0E95443A125EAC073999AAF8391E221F72F75A33CB0
SHA-512:	5E3C21BBA3CC652BACB2B32187D62682F441F2E484386C850372DFB39CF2ADCE3B092DD4AA418BC7AA913F0F3A9527E68CABBE9A93158EFD5AE3B997D05FAA2E
Malicious:	true
Preview:	PK.........n.Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[...2.$...71..r..,..t.b.1....>.......7.kG..4....{.....#..V..&7;V.%.........1.wy.gl..d..f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^.FQ#..R.... .....C/..z..b.2..C.m."....4.CR......&hD..n.d.IU....0).<..8.)....e.......#A.7}2......."n0.{...J*..\|......nbN.../p.....'..5......D.M!.m.e9...'..T_G.....(.........cp.(..1..H..j...R.$.......N...;.@...A..........6.R..u..e..i.;E.)1..v.o...3.a....I=F5.......<!.q..U.I..:.s....T.J.3.....O^{...!.I},....3.....@..0..(....3.]z?.....C.'zu..Z.Yr....gh.&dx@~....e....BG.`...PK.....bH...;...PK.........n.Y............"...kingDavid/k.class/caesium_27.classc..PK..............PK.........n.Y............"...kingDavid/k.class/caesium_26.classc..PK..............PK.........n.Y............"...kingDavid/k.class/caesium_25.classc..PK..............PK.........n.Y................kingDavid/b.class/.{wtUE.......u........^.."(.6..(...B........`W...+..P.

C:\jar\META-INF\MANIFEST.MF

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.173933501576146
Encrypted:	false
SSDEEP:	6:1KItJtf9H3FpL64wuoQ8FUs5R4bUAEENIy:1Tt/fZbL6lP55ENF
MD5:	53C8F62AEF3CD9A029D5B7A61D7E12F8
SHA1:	2BE9A56B9A6F704E6AF6C6D495E37D9395696A61
SHA-256:	C5E4A917D632FE6D3EBBF811CB2CF51266C6E303905A3B88F1645D2AC3A2BAF2
SHA-512:	52D41696BC014149E6335C05C87E1065C5F550A5C9CEC66484552DCD03BDE06B8DD1D0507D87043FB2E82E72055489E0CF68A1CF6544AD44248C9C677E41CB12
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: C:\jar\META-INF\MANIFEST.MF, Author: Joe Security
Preview:	Manifest-Version: 1.0..Ant-Version: Apache Ant 1.9.7..Created-By: 1.8.0_381-b09 (Oracle Corporation)..Class-Path: ..X-COMMENT: Main-Class will be added automatically by build..Main-Class: kingDavid.FirstRun..Obfuscated-By: Caesium DEBUG..

C:\jar\kingDavid\FirstRun.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\McHelper.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\McHelper.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\a.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\a.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\a.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\a.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\b.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\b.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\b.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\b.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\b.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\c.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\c.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\d.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\d.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\e.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\e.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\e.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\e.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\e.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\e.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_18.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_19.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_28.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_29.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\f.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\g.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\g.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\g.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\h.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\h.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\h.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\h.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\h.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_18.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_19.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_28.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_29.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\i.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\j.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\j.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\j.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\j.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\j.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\j.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\k.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\k.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\k.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\l.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\l.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\l.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\l.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_19.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_28.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_29.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\m.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_18.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_19.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_28.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_29.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\n.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\o.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\o.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\o.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\o.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\p.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\p.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\p.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\p.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\p.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\p.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\q.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\q.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\q.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\q.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\q.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\q.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\r.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\r.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\r.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\resources\config.txt

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.825408205098498
Encrypted:	false
SSDEEP:	6:c8Y+ynmquN1NRMe1zm2Ndmn1pS8rx6QlfpxS+KCEzBilc:c8Ytb+HRMewgmn1v6ufXSC0ilc
MD5:	94E779A8059A39A082DFC15BF603979C
SHA1:	671505646E9443916412BD1DB3881E5F01A1A1EE
SHA-256:	4317329C3AB5F8846DF1C0610E2E7BD762B45D4A99EF200469C228C2B40D1C9C
SHA-512:	D1C063B90BFC72A5FC24A41C9E1FC8A6056329CB5821AE92D5162743AE6458ABC34415498B38AAEB30A49445EE1DCABB88B421C5027C0102BB1D2A6123BE24E8
Malicious:	false
Preview:	AAAAEMR8M1LZMxnCMW4eQW+0dQXJk0qvY8z9nB9H21b2rKvEP6sPhkbDUMcLDYgevEhr8/mbE2IO3ZPRz7WE3CnZiJ0hn3Nvl/2lNg5+4+TCq0mOk0HJzfeQOKVdlowT/kFwC30OmuNc1HKIUlN8p+gRowTs9K0IQeK3u8pX1dZXr9IdYju3uwhdI+5/H6DYMuaiE0ZqTPG9NlIHS+MNjbdPm8Vma/eIKT67xO9xVaUk6LyH

C:\jar\kingDavid\s.class\caesium_18.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_19.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_28.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_29.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\s.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\t.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\u.class\caesium_24.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\u.class\caesium_25.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\u.class\caesium_26.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\u.class\caesium_27.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\u.class\caesium_30.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\jar\kingDavid\u.class\caesium_31.class

Download File

Process:	C:\Windows\System32\7za.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.8909723601756
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	Shipping Bill No6239999Dt09122024.PDF.jar
File size:	201'515 bytes
MD5:	fb02745de7ec057a90b207602e732be6
SHA1:	c1ecc13f6f7b8043918cc17a4fb88fb29c6ba9d0
SHA256:	84481aed848a500ec03fb0e95443a125eac073999aaf8391e221f72f75a33cb0
SHA512:	5e3c21bba3cc652bacb2b32187d62682f441f2e484386c850372dfb39cf2adce3b092dd4aa418bc7aa913f0f3a9527e68cabbe9a93158efd5ae3b997d05faa2e
SSDEEP:	3072:KROA9tsCGC9tChoYvQlzwVa37ZGfteVTzg4U5N0iVfG6lfAANinzk4U86vLiy:I9aLC9EjYrrZGfteVTyjn12ANmo4Jy
TLSH:	8814BD14BB8090B2E3B760B2085D9319B874A4EFC66CA6870FF1EC1FDC16D651F61AB5
File Content Preview:	PK.........n.Y................kingDavid/k.class/]PQO.P.=w.u+.nCEQ.Tt.q[....2.$...71..r..,..t.b.1....>........7.kG..4......{.....#..V..&7;V.%.............1.wy.gl..d...f..1..Ur...Y%..8Ch.Bw.r.Z.iY#oP."\|y3W%.Q..t5....\.7...S4=....N......iY.H^..FQ#..R...... .

File Icon


Icon Hash:	d08c8e8ea2868a54

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T11:51:38.196132+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:43.219750+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:48.220613+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:53.219771+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:51:58.224198+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:03.222223+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:08.235827+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:13.250679+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:18.250768+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:23.255917+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:28.250575+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:33.266150+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:38.282232+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:43.297696+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:48.297840+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:53.313456+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:52:58.331363+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:03.344829+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:08.344781+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:13.409267+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:18.360532+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:23.376397+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:23.677391+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP
2024-12-17T11:53:28.376446+0100	2030358	ET MALWARE STRRAT CnC Checkin	1	192.168.2.4	49730	194.59.30.164	1790	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 11:51:29.974524021 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:30.094377041 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:30.094463110 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:36.852844000 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:51:36.973072052 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:51:36.973150969 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:51:36.973500013 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:51:37.094603062 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:51:38.073508978 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:51:38.073627949 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:51:38.073708057 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:51:38.076086044 CET	49731	80	192.168.2.4	208.95.112.1
Dec 17, 2024 11:51:38.076302052 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:38.196043968 CET	80	49731	208.95.112.1	192.168.2.4
Dec 17, 2024 11:51:38.196069002 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:38.196131945 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:38.315963030 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:43.099647045 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:43.219671965 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:43.219749928 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:43.339675903 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:48.099730015 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:48.220082998 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:48.220613003 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:48.340512991 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:53.099739075 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:53.219666004 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:53.219770908 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:53.339850903 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:58.101824999 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:58.221494913 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:51:58.224198103 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:51:58.343933105 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:03.102281094 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:03.221971989 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:03.222223043 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:03.342030048 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:08.115042925 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:08.235752106 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:08.235826969 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:08.355623007 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:13.130690098 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:13.250509977 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:13.250679016 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:13.370522022 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:18.130799055 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:18.250576019 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:18.250767946 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:18.370553970 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:23.130798101 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:23.251606941 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:23.255917072 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:23.375766993 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:28.130623102 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:28.250438929 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:28.250575066 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:28.370440960 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:33.146337032 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:33.266081095 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:33.266149998 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:33.386135101 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:38.162161112 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:38.282113075 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:38.282232046 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:38.401926041 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:43.177666903 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:43.297632933 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:43.297696114 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:43.417654037 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:48.177911997 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:48.297779083 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:48.297840118 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:48.417678118 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:53.193522930 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:53.313327074 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:53.313456059 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:53.433310986 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:58.210671902 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:58.331103086 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:52:58.331362963 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:52:58.451201916 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:03.224874020 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:03.344774961 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:03.344829082 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:03.464497089 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:08.224780083 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:08.344655991 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:08.344780922 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:08.468322992 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:13.224566936 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:13.409077883 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:13.409266949 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:13.653493881 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:18.240123034 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:18.360389948 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:18.360532045 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:18.480798960 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:23.255791903 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:23.375714064 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:23.376396894 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:23.677391052 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:23.708369017 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:23.798352003 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:28.255897045 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:28.376296997 CET	1790	49730	194.59.30.164	192.168.2.4
Dec 17, 2024 11:53:28.376446009 CET	49730	1790	192.168.2.4	194.59.30.164
Dec 17, 2024 11:53:28.496624947 CET	1790	49730	194.59.30.164	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 11:51:29.422776937 CET	59660	53	192.168.2.4	1.1.1.1
Dec 17, 2024 11:51:29.961410046 CET	53	59660	1.1.1.1	192.168.2.4
Dec 17, 2024 11:51:36.623537064 CET	64488	53	192.168.2.4	1.1.1.1
Dec 17, 2024 11:51:36.851596117 CET	53	64488	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 11:51:29.422776937 CET	192.168.2.4	1.1.1.1	0x727b	Standard query (0)	evilginx.misecure.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 11:51:36.623537064 CET	192.168.2.4	1.1.1.1	0x903e	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 11:51:29.961410046 CET	1.1.1.1	192.168.2.4	0x727b	No error (0)	evilginx.misecure.com		194.59.30.164	A (IP address)	IN (0x0001)	false
Dec 17, 2024 11:51:36.851596117 CET	1.1.1.1	192.168.2.4	0x903e	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	3744	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 11:51:36.973500013 CET	188	OUT	GET /json/ HTTP/1.1 Host: ip-api.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36 Connection: close
Dec 17, 2024 11:51:38.073508978 CET	483	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 10:51:37 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	05:51:25
Start date:	17/12/2024
Path:	C:\Windows\System32\7za.exe
Wow64 process (32bit):	true
Commandline:	7za.exe x -y -oC:\jar "C:\Users\user\Desktop\Shipping Bill No6239999Dt09122024.PDF.jar"
Imagebase:	0xa10000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000000.00000003.1713177823.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:51:25
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:51:26
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
Wow64 process (32bit):	true
Commandline:	java.exe -jar "C:\Users\user\Desktop\Shipping Bill No6239999Dt09122024.PDF.jar" kingDavid.FirstRun
Imagebase:	0x8d0000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000002.00000002.1729710613.0000000009A29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000002.00000002.1729710613.0000000009998000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000002.00000003.1714483688.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000002.00000002.1729710613.0000000009968000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:51:26
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:51:26
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x180000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:51:26
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:51:27
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:51:27
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Imagebase:	0x840000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000007.00000003.1728437363.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000007.00000002.2961944320.0000000009E28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000007.00000002.2961944320.0000000009D68000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000007.00000002.2961944320.0000000009D97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:51:27
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x500000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:51:27
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:51:27
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Imagebase:	0x950000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:51:29
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:51:29
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:51:29
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
Imagebase:	0xb20000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:51:30
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:51:30
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:51:30
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
Imagebase:	0xb20000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:51:32
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:51:32
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:51:32
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
Imagebase:	0xb20000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:51:34
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:51:34
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:51:34
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
Imagebase:	0xb20000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:51:39
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Imagebase:	0x3a0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000017.00000002.2962128496.000000000A197000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000017.00000002.2962128496.000000000A228000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000017.00000002.2962128496.000000000A168000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 00000017.00000003.1844452207.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	05:51:55
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar"
Imagebase:	0x3a0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001B.00000003.2001658470.0000000001615000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001B.00000002.2962620921.000000000A597000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 0000001B.00000002.2962620921.000000000A568000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001B.00000002.2962620921.000000000A628000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:52:03
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar"
Imagebase:	0x3a0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 0000001C.00000002.2962223596.000000000A567000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001C.00000003.2083062525.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001C.00000002.2962223596.000000000A627000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CaesiumObfuscator, Description: Yara detected Caesium Obfuscator, Source: 0000001C.00000002.2962223596.000000000A596000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 0235D9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002352000.00000040.00000800.00020000.00000000.sdmp, Offset: 02352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2352000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ced2fdf8e27a1d8553271e0004b74cddf98aa2734bdd22fa7e9cb189036d619
Instruction ID: 6418f59c596ac2fe55b241636e0c693454d84ee27cdf1be1c17c94a092659562
Opcode Fuzzy Hash: 2ced2fdf8e27a1d8553271e0004b74cddf98aa2734bdd22fa7e9cb189036d619
Instruction Fuzzy Hash: 0F8178B1A046299FDB28CF64C594BA9F7B1FF49714F088199DC1E4B392CB34A885CB91

Function 02350672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2350000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction ID: f709d92e1bdc2466dc7294162a49ab1472fef6e8e1b77ff9aae9b227e45185ab
Opcode Fuzzy Hash: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction Fuzzy Hash: 771149B690023ADFCF18CF48C4958ADB7B0FB9C314F164525DC69A3741D335A920CB90

Function 02350722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2350000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction ID: beade77604ae9609d316291dea370c4ff964082f2c95330fe77091549c389280
Opcode Fuzzy Hash: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction Fuzzy Hash: 82F01576C00269DBCB18DF48C5414ADBBB1EB48318B1A8496DC2C37241D332AD62CF81

Function 02364B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002352000.00000040.00000800.00020000.00000000.sdmp, Offset: 02352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2352000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d292dc1579a1b26c2ac2a137198a2ab01882ac773a41229294118e7a8cca134c
Instruction ID: d7aafdc1ce0e107689d95942b9f24e4ddb863ac2499bc343d62f7a443bec4fae
Opcode Fuzzy Hash: d292dc1579a1b26c2ac2a137198a2ab01882ac773a41229294118e7a8cca134c
Instruction Fuzzy Hash: A2F07FB6A00A16EBDB198F61C0447DAFBB4FB88718F14421AD82C57350D779B4658BD0

Function 0235DA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002352000.00000040.00000800.00020000.00000000.sdmp, Offset: 02352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2352000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ba1fddd8d8c4b4b32f32fa3eb8ca7018a40687efc1e6724b2e64574f64812a
Instruction ID: ec63561dff9c81534f38c16bbda1935777cc2c14274e0acd1b3f6281b4fd5a73
Opcode Fuzzy Hash: 82ba1fddd8d8c4b4b32f32fa3eb8ca7018a40687efc1e6724b2e64574f64812a
Instruction Fuzzy Hash: 33F0CAB6D00A1AABDB248F61C0447DAFBB4BB88714F18421AC82C67320D378B469CBD0

Function 023649AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002352000.00000040.00000800.00020000.00000000.sdmp, Offset: 02352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2352000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493f1547eaff1b714bf3401970ac187fad1bd0094c01027da2fbf4aa93355fd3
Instruction ID: f40ebe58edcdc0f14580069ac034093a3bc71e5690d96716c2686d0f2b941cc2
Opcode Fuzzy Hash: 493f1547eaff1b714bf3401970ac187fad1bd0094c01027da2fbf4aa93355fd3
Instruction Fuzzy Hash: 50F0C2B6D00A16ABDB248F61C0447CAFBB4BB48714F14421AC42C67310D378B465CBC0

Function 02363C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002352000.00000040.00000800.00020000.00000000.sdmp, Offset: 02352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2352000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9374a6ff0440bc40453566df2b74a81f8cf3212819a8c959cba78b2819f2d29
Instruction ID: 2b014e54ce1cdaba2a0dc67b812e49aa2cff8164c8449b154cac924d61a03387
Opcode Fuzzy Hash: d9374a6ff0440bc40453566df2b74a81f8cf3212819a8c959cba78b2819f2d29
Instruction Fuzzy Hash: 7BF0C2B6D00A16ABDB248F61C0447CAFBB4BB48714F15421AC42C67310D378B465CBC0

Function 023645E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002352000.00000040.00000800.00020000.00000000.sdmp, Offset: 02352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2352000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8033e9cec543667f1c70d725b0926daced800ac3faf09ab274e48efecf4a6d7
Instruction ID: 26d7722f7f56c53255323ff467ebc967a1471c3af9517220490b8412b090c971
Opcode Fuzzy Hash: e8033e9cec543667f1c70d725b0926daced800ac3faf09ab274e48efecf4a6d7
Instruction Fuzzy Hash: 0EF0C2B6D00A16ABDB248F65C0447CAFBB4BB48714F14421AC52C63350D378B465CBC0

Function 02364EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002352000.00000040.00000800.00020000.00000000.sdmp, Offset: 02352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2352000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a518eecc80596005b036769b0f8e3ce1b6810fbff83958fd0c8a4963ba7b360
Instruction ID: 7175f80544de56999326400f430fa72aa6ebfcc49f0c9cc1508c107afd376255
Opcode Fuzzy Hash: 7a518eecc80596005b036769b0f8e3ce1b6810fbff83958fd0c8a4963ba7b360
Instruction Fuzzy Hash: 6DF0CAB6D00A1AABDB24CF61C10478AFBB0FB88B18F14421AC82C63710C378B865CBC0

Non-executed Functions

Function 023503C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1728741849.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2350000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction ID: 03a3d31b76c58f1f14e3f99e3d3afb50c3c0e798911a88874a90974914819192
Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction Fuzzy Hash: CE2106BA6042668FDB358F188C407D9B7E5FB08314F21882EDECDE7711D334AA898B50

Analysis Process: java.exePID: 3744, Parent PID: 396COMMON

Executed Functions

Function 02679712 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.0000000002674000.00000040.00000800.00020000.00000000.sdmp, Offset: 02674000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2674000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d61b72422c36aaf2697596f7e318239e58512b0ad3fe2d099eab14bdb5610c7
Instruction ID: 3feb01364564f8e75929bb969701d5c3957e0eeb27696757d7dc9cbfa309091b
Opcode Fuzzy Hash: 7d61b72422c36aaf2697596f7e318239e58512b0ad3fe2d099eab14bdb5610c7
Instruction Fuzzy Hash: 8BD12A75A0A340CFC718DF29D08462ABBF2FB85314F6589AEE4899B355D735E842CF81

Function 025DD9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0725d8cbdb8db6753da5fa76efd16a633d92c08933662467ec650b70ff4638fc
Instruction ID: 65b2a91b973170c49dee24af823ce11ecf6d704e1ec2d8b27e22b5d0c0ffeb72
Opcode Fuzzy Hash: 0725d8cbdb8db6753da5fa76efd16a633d92c08933662467ec650b70ff4638fc
Instruction Fuzzy Hash: 9881B276A06601DFDB28CF68C594BA9FBB1FF49318F08859DC81A4B391CB34A845CF95

Function 025D0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction ID: 6fdb8e26ac716bbe1e40b94c25fd8e460203a7e1d5251106565085aa9b4772df
Opcode Fuzzy Hash: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction Fuzzy Hash: 67115BB6D0122ADFCF24CF4CC4854ADBBB0FB98314F164529EC65A7381D3346960CB95

Function 025D0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction ID: f33eda069c07272914401f4e36b9204ee77603fc6f1936b1431280f43c08281d
Opcode Fuzzy Hash: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction Fuzzy Hash: 13F0A57AC00269DB8B24DF48C4411ADBBB1FB49318F1A8496DC697B381D332AD62CF95

Function 025E4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7058c54dcabddae9a5e041c9fa0cc546b52d103b29b6e8b8d834e4ee5f3a4c5e
Instruction ID: 069949b4d18f22391a578cd0a90f77e3d68f5047ecc135fceaead39ac23bcd9d
Opcode Fuzzy Hash: 7058c54dcabddae9a5e041c9fa0cc546b52d103b29b6e8b8d834e4ee5f3a4c5e
Instruction Fuzzy Hash: D4F07FB6A04A16EBDB258F65C0047DAFBB4BB88718F14421AD42C57350D778B465CBD0

Function 025E6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89fd47cb902d47da9aeece326625e309a4cafa3e3f2a446c5bbdd654a64fe61
Instruction ID: 21f8c9c0246fff18779173e0b913431760b1de8cf0c54e6360073b82c4f72b30
Opcode Fuzzy Hash: e89fd47cb902d47da9aeece326625e309a4cafa3e3f2a446c5bbdd654a64fe61
Instruction Fuzzy Hash: 9AF09BBAA04A16EBDB26CF65C0047CAFBB4BB88714F14421AD42C67350D778B469CBC0

Function 025DDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab5d40888c036579d85c7bdcb38bc5abfaf6b5749c84d784763184eda3aaf9e
Instruction ID: 992d7da0aa63b4dc8b34c11ec473c37862a94b6057d4001cc01cd347bcaa9a53
Opcode Fuzzy Hash: fab5d40888c036579d85c7bdcb38bc5abfaf6b5749c84d784763184eda3aaf9e
Instruction Fuzzy Hash: 96F0CAB6D00A1AABDB248F65C0047DAFBB4BB88714F18421AC42C67360D378B469CBD0

Function 025E49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07b88d73e0ec5c4d2186b11507ba6c1046c6012640820ed68e3c6d936305ad9
Instruction ID: 1a6807413724c9611ea45ce09853f2defec750d798e915449fc9da7bf386f3b3
Opcode Fuzzy Hash: f07b88d73e0ec5c4d2186b11507ba6c1046c6012640820ed68e3c6d936305ad9
Instruction Fuzzy Hash: 27F0CAB6D00A16ABDB248F65C0047CAFBB4BB88718F14421AC42CA7360D378B469CBC0

Function 025E3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66905acb10d4d5c2a2b4d144ec631bf0841d71935e9ebd162f21dbd41ebe5382
Instruction ID: 4e709c04348c3535a3a53e4a092a4855e556607e0d63a33dd3d60a6145678bba
Opcode Fuzzy Hash: 66905acb10d4d5c2a2b4d144ec631bf0841d71935e9ebd162f21dbd41ebe5382
Instruction Fuzzy Hash: 19F0CAB6D00A1AABDB648F65C0047CAFBB4BB88718F15421AC42CA7360D378B469CBC0

Function 025E45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ca1a6797cf1898ddaafb79ea7483560e097ce511d2eec78d55133cb07ec96a
Instruction ID: c5b1594d840053368db649d2be73ad162213cf1cbd1dc0b7c44e2a4eaef17914
Opcode Fuzzy Hash: 75ca1a6797cf1898ddaafb79ea7483560e097ce511d2eec78d55133cb07ec96a
Instruction Fuzzy Hash: 3BF0C2B6D00A16ABDB248F65C0047CAFBB4BB44714F14421AC52C63350D378B465CBC0

Function 025E4EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.00000000025D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b68c116487bf99feb76bfbe47a8f88fd18509c67aad8fdcbf620be4d8587933
Instruction ID: d879cb5ff91ecca26e472361f71cde54c4300fbf906b596ecb854b66de9fe994
Opcode Fuzzy Hash: 8b68c116487bf99feb76bfbe47a8f88fd18509c67aad8fdcbf620be4d8587933
Instruction Fuzzy Hash: 52F0CABAD00A1AABDB24CF61C10438AFBB0BB88B18F14421AC42D63750C378B865CBC0

Non-executed Functions

Function 0267E406 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2958748008.0000000002674000.00000040.00000800.00020000.00000000.sdmp, Offset: 02674000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2674000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9648e87a7b50ac75c21ce1a2cf0c962df324a7c6b7e70e3b7563904a9a40dc16
Instruction ID: 93b4254adaa163445053eecad8df707e0275aa4f81dd26fbe49ee79659a183bf
Opcode Fuzzy Hash: 9648e87a7b50ac75c21ce1a2cf0c962df324a7c6b7e70e3b7563904a9a40dc16
Instruction Fuzzy Hash: DCF0A5A640E7E08FE7078724A8A66D17F70EF2772474A85CBC4C4CE1A7D66A454FC722

Analysis Process: javaw.exePID: 4544, Parent PID: 2580COMMON

Executed Functions

Function 029CD9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3feac2ee3c1cb8393ccb1e18b938feaa2bf88b38fd553863f74997c3386998a2
Instruction ID: 974ac0fb6295acbab7752ae40ed105d1358f585b71f244e920b4b89d43482a6b
Opcode Fuzzy Hash: 3feac2ee3c1cb8393ccb1e18b938feaa2bf88b38fd553863f74997c3386998a2
Instruction Fuzzy Hash: 4881DFB1A04601DFDB18CF64C594BA9F7B5FF49314F2885ADC81A4B392CB34A944CFA2

Function 029C0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction ID: e9089e89129921fb4e77f66adbb0e782ef200fa8a1c992a776b642db000d0ec6
Opcode Fuzzy Hash: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction Fuzzy Hash: 31115BB6D0022ADFCF18DF48C9855ADB7B4FB98314F664629DC69A3341D3346920CB92

Function 029C0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction ID: 2ecc1f2ae59b1a4fd34726c79778d81f80da2225d1230f846c9bd64bbeda337c
Opcode Fuzzy Hash: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction Fuzzy Hash: C4F01C76C00229DB8F14DF44C5400ADF771FB44218F29849ADC2C37241D3326D61CF82

Function 029D4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9afccf81d4d6a9fc688239790d4d10b22c7929400b6cffe76e6e2823933e234e
Instruction ID: 372e2d70e225be1259515fbe22f614f371da710d808a2fc6e01ebd68abc8eec1
Opcode Fuzzy Hash: 9afccf81d4d6a9fc688239790d4d10b22c7929400b6cffe76e6e2823933e234e
Instruction Fuzzy Hash: 3DF07FB6A00A16EBDB15CF61C1047DAFBB4BB88718F14421AD42C57350D778B4658BD0

Function 029D6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac03aab89b4fc99cd3dd90c3e497216ad15c9e898f1980e852c06dfb923e2286
Instruction ID: eba6bf0ae5e7b90a3e0475cae7da53d534dd19169bfd1cc2b723f0af6cca8914
Opcode Fuzzy Hash: ac03aab89b4fc99cd3dd90c3e497216ad15c9e898f1980e852c06dfb923e2286
Instruction Fuzzy Hash: A2F09BB6A04A16EBDB26CF65C1047CAFBB4BB88714F14421AD42C67350D778B469CBD0

Function 029CEC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee92b74eaaedff847b286347427a6c1135421137f09ce4fa7e3407b08411963b
Instruction ID: dd9a7f0a1c314bb69122417860ed8e8b4d09acd2763aca6fce9f5b872fee6bf9
Opcode Fuzzy Hash: ee92b74eaaedff847b286347427a6c1135421137f09ce4fa7e3407b08411963b
Instruction Fuzzy Hash: 59F09BB6A00A16EBDB29CF61C1087DAFBB4BB88718F14421AC42C67750D778B469CBD0

Function 029CDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada37616718774ea6ccd0b7959cc0ac23451d62472db1edb064310e410eb100b
Instruction ID: 22b72d8f17817908f2c9e7de29c989e627fbf2d8d11a172515ed4829c8d9ea48
Opcode Fuzzy Hash: ada37616718774ea6ccd0b7959cc0ac23451d62472db1edb064310e410eb100b
Instruction Fuzzy Hash: 5AF0C2B6D00A16EBDB24CF61C1047DAFBB4BB44714F14421AC42C67310D378B465CBD0

Function 029D49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c647ca9b33aaaf957fcbe155cbf81a1265ff420d652a2417db453db46854a408
Instruction ID: 7bee04a922bc0960499fac246cf8ffe48f4c88c5aa64dc08a7a1142133dead6e
Opcode Fuzzy Hash: c647ca9b33aaaf957fcbe155cbf81a1265ff420d652a2417db453db46854a408
Instruction Fuzzy Hash: B6F0C2B6D00A16EBDB24CF61C1047CAFBB4BB48714F14421AC42C67310D378B465CBD0

Function 029D3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155c4aff8cf3b35f4149c0721122f1a6c7ad5ac6afcedc58375429d503d8f435
Instruction ID: 94e8447b664e8f73abb86ea7e9dc0796d3c95f03a26ae1844e108e0b81d47577
Opcode Fuzzy Hash: 155c4aff8cf3b35f4149c0721122f1a6c7ad5ac6afcedc58375429d503d8f435
Instruction Fuzzy Hash: FBF0C2B6D00A16EBDB24CF61C1047CAFBB4BB44714F15421AC42C67310D378B465CBD1

Function 029D45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693a70a752eb1466df056953283a6a264c2c9201c48163fe18a3939641bbd368
Instruction ID: bf64423197247ceaa95afd41b9eeeffddf88f76a0308eadf7dd0556d7027e04f
Opcode Fuzzy Hash: 693a70a752eb1466df056953283a6a264c2c9201c48163fe18a3939641bbd368
Instruction Fuzzy Hash: FFF0C2B6D00A16EBDB24CF65C1047CAFBB4BB44714F14421AC52C63350D378B465CBD0

Function 029D4EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2959065171.00000000029C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_29c2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c37a6876e8e2cda2d20e3ef0b25f452ddc5e72c07ee81e72362e3adf936a66
Instruction ID: c186b2785ee6e4b6b675993be8d0d9b5a411e25eb116466e505f0d408b3d7df6
Opcode Fuzzy Hash: 06c37a6876e8e2cda2d20e3ef0b25f452ddc5e72c07ee81e72362e3adf936a66
Instruction Fuzzy Hash: 63F0CAB6D00A1AEBDB24CF61C10438AFBB4BB88B18F14421AC42C63710C378B865CBC1

Analysis Process: javaw.exePID: 4596, Parent PID: 2580COMMON

Executed Functions

Function 02ECD9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2845313375b3759f9201b4ef272faa221bd3e30f2ff0214a8209496bbe210e3b
Instruction ID: 93f3e7dcfd46eff700a52bff567aec6846febd8011e75b0011b176e46b24dd5f
Opcode Fuzzy Hash: 2845313375b3759f9201b4ef272faa221bd3e30f2ff0214a8209496bbe210e3b
Instruction Fuzzy Hash: 70819EB1A44601DFDB18CF94CA94BA9F7B1FF49318F24D1ADD81A4B381C736A846CB90

Function 02EC0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction ID: a366229b83ffc43cb08f297c42bb0049a0f84b5f1afee35a08097891086081e3
Opcode Fuzzy Hash: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction Fuzzy Hash: 641151B6D4022ADFCF14DF88C5855ADB7B0FB58318F258529DC65A3741D3346921CB90

Function 02EC0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction ID: 87f29687735da14d67def08a6a564d9ba54e4141c95cb49563177bf5acca816d
Opcode Fuzzy Hash: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction Fuzzy Hash: A8F01C76C40229DB8B14EF84C5400EDF771EB4421CB29C49ADC2C37241D3326D52CF81

Function 02ED4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb3da491a6cf878cf013816811daa9b8940a1a1badcc5a4b217b5c4899c0362
Instruction ID: d8614808a2010a2da786d06a87b74db5334eba1daa731fb761fba28ef0b89d74
Opcode Fuzzy Hash: fdb3da491a6cf878cf013816811daa9b8940a1a1badcc5a4b217b5c4899c0362
Instruction Fuzzy Hash: 8CF07FB6A00A16EBDB15CF61C1047DAFBB4BB88718F14821AD82C57750D778B4668BD0

Function 02ED6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2c6b47c7e0822d9737d665ff15ef7e966c81bdc0c2363c2f4004bb2ef3c39d
Instruction ID: 0de794c13cb109195030fa9e00384a584a4cf6d46be0ffa8b2d8a2676cb610aa
Opcode Fuzzy Hash: 3e2c6b47c7e0822d9737d665ff15ef7e966c81bdc0c2363c2f4004bb2ef3c39d
Instruction Fuzzy Hash: 7DF092B5904A16EBDB15CF65C1047CAFBB4BB48714F14421AD42C67750D778B465CBC0

Function 02ECEC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71659bab748dd7b99836d29083f13491512a2cb0313185376b83c6ef3f3ecf28
Instruction ID: d6925b17ae920648923c4d2c0d20587212a29aa46f67d77cf93510e033c2a186
Opcode Fuzzy Hash: 71659bab748dd7b99836d29083f13491512a2cb0313185376b83c6ef3f3ecf28
Instruction Fuzzy Hash: AEF092B5900A16EBDB15CF61C1047DAFBB4BB88718F14521AC42C67750D778B469CBC0

Function 02ECDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b099e26bd4467bfd9d1535e314b6f3e73312af48bfd66f1356137a738b216386
Instruction ID: 828a8999f8cbca7484a9a43eaaa133e7f2726eb73dc09065c4a8533b10a7883a
Opcode Fuzzy Hash: b099e26bd4467bfd9d1535e314b6f3e73312af48bfd66f1356137a738b216386
Instruction Fuzzy Hash: E4F0C2B6D00A16EBDB24CFA1C1047DAFBB4BB44714F14421AC42C67710D378B465CBD0

Function 02ED49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49929165720543a233d5ffab3ef4b87fa2150d1900eb4a07ffdb5e0d22e290b9
Instruction ID: b332fae41cc9717e328a9e3e9476568cc27f2a754b3c062ee3eb1a09d4ecd7e2
Opcode Fuzzy Hash: 49929165720543a233d5ffab3ef4b87fa2150d1900eb4a07ffdb5e0d22e290b9
Instruction Fuzzy Hash: BBF0C2B6D00A16EBDB24CFA1C1047CAFBB4BB48718F14421AC42C67710D378B465CBC0

Function 02ED3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450f17ccb9ee0dd6fd9387a3f69bfaade7c94ff39ec49aa45a55c34a0d8f83ba
Instruction ID: e31943a5c7c4d903cb18216d03754e43a8266975cfb33747ee79d55d1f8c867b
Opcode Fuzzy Hash: 450f17ccb9ee0dd6fd9387a3f69bfaade7c94ff39ec49aa45a55c34a0d8f83ba
Instruction Fuzzy Hash: 76F0C2B6D00A16EBDB24CFA1C1047CAFBB4BB44718F15421AC42C67710D378B465CBC0

Function 02ED45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a999b90eff59fa21d5f652705539af576e00840ed0f5438aba595010e759ba3e
Instruction ID: 962e876c8006162f235201937963758c9fe864ed4f34e4aa8ff0809fa88b10bf
Opcode Fuzzy Hash: a999b90eff59fa21d5f652705539af576e00840ed0f5438aba595010e759ba3e
Instruction Fuzzy Hash: 22F0C2B6D00A16EBDB24CFA5C1047CAFBB4BB44724F14421AC52C63750D378B465CBC0

Function 02ED4EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2958746129.0000000002EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2ec2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b718ee38f5af528b4a0704e8e4f7b893ab37baa5f9e13e7c7b053f7c63b419ca
Instruction ID: 175540c21f769840b3fad2713b0bfef24348d904e7012311fc94e2f03c29815b
Opcode Fuzzy Hash: b718ee38f5af528b4a0704e8e4f7b893ab37baa5f9e13e7c7b053f7c63b419ca
Instruction Fuzzy Hash: 04F0C2B5D00A16EBDB24CF61C10438AF7B0BB44B18F14421AC42C63710C378B465CBC0

Analysis Process: javaw.exePID: 4320, Parent PID: 2580COMMON

Executed Functions

Function 02DED9A5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb511eb9c0d94982f5bc064e312a554e4de55246633d2d5ecc30f2620a2ada2
Instruction ID: c0b24be983075dc68bbb5d944358d60e873ce50440878a70a054e1c7352bec7a
Opcode Fuzzy Hash: 8bb511eb9c0d94982f5bc064e312a554e4de55246633d2d5ecc30f2620a2ada2
Instruction Fuzzy Hash: 94818971A046019FDF18EF24C594BA9F7BAFB49314F18819DC81A8B381DB34AD44CBA0

Function 02DE0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction ID: 5546ba9ef135fb0932edc7eb5408d6351c61aec173afb5e00af637bc30c91387
Opcode Fuzzy Hash: 8d1c0f6fac04777cf1c6f0ace0b7e4d99dd3506a8a8ef1bab6aaaecf45cc1d77
Instruction Fuzzy Hash: 7C1149B690026ADFCF14EF48C4855ADB7B0FB98315F1A8529DCA6B3341D374AD20CB90

Function 02DF4CCD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a4a85c29a5ea70af1e0c2b2fbf9c4f86308147c4191c936121ddc9ea18ba58
Instruction ID: 4c9a32798b81f05af8c2204271626e7fc34dc419c2b3fa5f674fd0f24772648d
Opcode Fuzzy Hash: 26a4a85c29a5ea70af1e0c2b2fbf9c4f86308147c4191c936121ddc9ea18ba58
Instruction Fuzzy Hash: 7DF0DFB5900A06EBEB15CF60C0047EAF7B4FB88704F04420AD42C67310C778B829CBD0

Function 02DE0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de0000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction ID: 76f3353e8c6f90f2759913b68977197bd8c6feaad5f41d32e8ad4558d4f6f715
Opcode Fuzzy Hash: 4b4649636eb844ca6d75492a46e264960b60508534b0609838e52dc126247f53
Instruction Fuzzy Hash: C3F0A576C00269DBCF14EF48C4411ADBBB1EB49218B1A8496DC6A7B341D372AD62CF91

Function 02DF4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a1053fca6372ed5f9eab1231c2d82b77e2c642303bbd612167c5f877627c0e
Instruction ID: b15a38b210133c691bd30d23ae5a0a2fd0f4836c644bd815d662252ab3cdbc55
Opcode Fuzzy Hash: 64a1053fca6372ed5f9eab1231c2d82b77e2c642303bbd612167c5f877627c0e
Instruction Fuzzy Hash: DAF07FB6A00A16EBDB158F61C0047DAFBB4BB88718F14421AD42C67350D778B865CBD0

Function 02DF6495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6aee373a76ab63986113e4c720d84da3c0eedfd7d226846e77dc3334bf51a3a
Instruction ID: c0493884d9185df57d14c165a5b8b2fc6b929cbaa09dc364444728a57629db7a
Opcode Fuzzy Hash: c6aee373a76ab63986113e4c720d84da3c0eedfd7d226846e77dc3334bf51a3a
Instruction Fuzzy Hash: E6F09BB6A04A16EBDB26CF65C0047CAFBB4BB88714F14421AD42C67350D7B8B869CBC0

Function 02DEEC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89628d2d9d462aaaabf730dfe0e0346e2dd9c3efaa6c2f622052d6e1f78b956
Instruction ID: 219670051c00c822b819f610825936fd0e9c2640004f7287f9ff4c6437cecebc
Opcode Fuzzy Hash: b89628d2d9d462aaaabf730dfe0e0346e2dd9c3efaa6c2f622052d6e1f78b956
Instruction Fuzzy Hash: 89F092B5900A16EBDB15CF61C0047DAFBB4BB88714F14421AC42C67750D778B469CBC0

Function 02DEDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df3d3b4a9ff8c84374acdab52918481884af784d87fd05dad3ef00395910ed6
Instruction ID: 3f9a8110b658baff6e1f3b70ffe08c85141709201ebfe86acd0a6611865d2f82
Opcode Fuzzy Hash: 6df3d3b4a9ff8c84374acdab52918481884af784d87fd05dad3ef00395910ed6
Instruction Fuzzy Hash: 05F0C2B6D00A16ABDB248F61C0047DAFBB4BB44714F14421AC42C67310D378B465CBD0

Function 02DF49AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8cdc1b75e52d03e4d95a40071a17f997ed7056c810b7457ca5c1ae3a5e771
Instruction ID: f18b49364892ce06679bedfd378dc813d0c8ea8c186c08966af73360bbf3ab0e
Opcode Fuzzy Hash: 14c8cdc1b75e52d03e4d95a40071a17f997ed7056c810b7457ca5c1ae3a5e771
Instruction Fuzzy Hash: A0F0C2B6D00A16ABDB248F61C0047CAFBB4BB48714F14421AC42C67310D378B465CBC0

Function 02DF3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228b7bbe38d53b291548c29fb67438ad8c87ccb412cde3f18e6bc8b0063180f9
Instruction ID: a85b91d1c2d338a3af4fc9402c8bbbc1105070af666fd96a1ea71374073ed16f
Opcode Fuzzy Hash: 228b7bbe38d53b291548c29fb67438ad8c87ccb412cde3f18e6bc8b0063180f9
Instruction Fuzzy Hash: FAF0C2B6D00A16ABDB248F61C0047CAFBB4BB44714F15421AC42C67310D378B465CBC0

Function 02DF45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040a8569088a0057f68e5c0562b6924b699133031826a546b2d5d301e55eb80c
Instruction ID: 468b67370d349d1d5885c70b07cadf6f6e6f075c2473553822e1d93d11d442d8
Opcode Fuzzy Hash: 040a8569088a0057f68e5c0562b6924b699133031826a546b2d5d301e55eb80c
Instruction Fuzzy Hash: DFF0C2B6D00A16ABDB248F65C0047CAFBB4BB44714F14421AC52C63350D3B8B465CBC0

Function 02DF4EF4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2958915480.0000000002DE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_2de2000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07450c965ac3e0f6142e5062a769da3bff5910b1218dd2997af6ea7e5644aeb1
Instruction ID: e49adad09919b21356d4e8913cdc6e3613bf8be1291c1f88d59503b1756e2e67
Opcode Fuzzy Hash: 07450c965ac3e0f6142e5062a769da3bff5910b1218dd2997af6ea7e5644aeb1
Instruction Fuzzy Hash: A5F0CAB6D00A1AABDB24CF61C10438AFBB0BB88B18F14421AC42D63710C3B8B865CBC0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipping Bill No6239999Dt09122024.PDF.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: STRRAT

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Shipping Bill No6239999Dt09122024.PDF.jar

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\3744

C:\Users\user\AppData\Local\Temp\hsperfdata_user\396

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4320

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4544

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4596

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill No6239999Dt09122024.PDF.jar

C:\Users\user\AppData\Roaming\Shipping Bill No6239999Dt09122024.PDF.jar

C:\jar\META-INF\MANIFEST.MF

C:\jar\kingDavid\FirstRun.class\caesium_27.class

C:\jar\kingDavid\McHelper.class\caesium_26.class

C:\jar\kingDavid\McHelper.class\caesium_27.class

C:\jar\kingDavid\a.class\caesium_24.class

C:\jar\kingDavid\a.class\caesium_25.class

Windows Analysis Report
Shipping Bill No6239999Dt09122024.PDF.jar